# plugins

repository: k3rn3Lp4n1cK/ctf-live-build-config
description: Custom Kali Live Builder for CTF's & OSCP
wanted_name: XML Importer
comment: Import XML PROGRAM file
created_at: 2023-01-28 21:06:18+00:00
pushed_at: 2023-05-18 00:05:00+00:00
file:
kali-config/common/includes.chroot/opt/ghidra_10.2.2_PUBLIC/Extensions/IDAPro/Python/6xx/loaders/xmlldr.py

url:
https://github.com/k3rn3Lp4n1cK/ctf-live-build-config/blob/6ca05257d5cdecfa6dc05ab1a8258506864f6edd/kali-config/common/includes.chroot/opt/ghidra_10.2.2_PUBLIC/Extensions/IDAPro/Python/6xx/loaders/xmlldr.py


repository: kaleidoscopeAI/kaleidoscope
wanted_name: XML Importer
comment: Import XML PROGRAM file
created_at: 2025-04-10 14:58:24+00:00
pushed_at: 2025-04-10 15:15:49+00:00
file:
kaleidoscope_project_organized/ghidra/ghidra_11.3.1_PUBLIC_20250219/ghidra_11.3.1_PUBLIC/Extensions/IDAPro/Python/6xx/plugins/xmlldr.py

url:
https://github.com/kaleidoscopeAI/kaleidoscope/blob/3bee4de8ec756d173c0ce6a370c4d8a8409baea8/kaleidoscope_project_organized/ghidra/ghidra_11.3.1_PUBLIC_20250219/ghidra_11.3.1_PUBLIC/Extensions/IDAPro/Python/6xx/plugins/xmlldr.py


repository: ntt-zerolab/Xunpack
file: zelos/src/zelos/ext/plugins/overlay/zelos_ida.py
description: Artifacts for our RAID 2023 paper, "Xunpack: Cross-Architecture Unpacking for Linux IoT Malware"
wanted_name: ZelosOverlay
comment: Load an overlay file generated by Zelos.
created_at: 2023-06-28 04:24:49+00:00
pushed_at: 2023-10-12 08:57:46+00:00
url:
https://github.com/ntt-zerolab/Xunpack/blob/c6baab334d88e08ec442ca5ed3b6c8b46e5cd09d/zelos/src/zelos/ext/plugins/overlay/zelos_ida.py

content:
# Copyright (C) 2020 Zeropoint Dynamics

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.

# You should have received a copy of the GNU Affero General Public
# License along with this program.  If not, see
# <http://www.gnu.org/licenses/>.
# ======================================================================

import ida_kernwin
import idaapi
import idc


class ApplyZelosOverlay(idaapi.action_handler_t):  # pragma: no cover
    """
    Applies the overlay from the user-selected memory snapshot.
    """

    def __init__(self):
        idaapi.action_handler_t.__init__(self)

    def activate(self, ctx):
        import json

        filepath = ida_kernwin.ask_file(
            False, "*.zmu;*.overlay;*", "Load Zelos Overlay..."
        )
        if filepath is None:
            return
        f = open(filepath, "r")
        zelos_data = f.read()
        f.close()

        zelos_data = zelos_data[len("DISAS\n") :]
        zelos_dump = json.loads(zelos_data)

        # Apply the overlay data
        for comment in zelos_dump["comments"]:
            ea = comment["address"]
            try:
                comment_text = str(comment["text"])
            except UnicodeEncodeError:
                comment_text = ""
            color = comment.get("color", 0x73F0DF)

            # Set color of instruction line
            idaapi.set_item_color(ea, color)
            idaapi.set_cmt(ea, comment_text, False)

            # Set function name if not already changed
            idc.get_func_attr(ea, idc.FUNCATTR_START)
            name = idc.get_func_name(ea)
            if len(name) > 0 and name.startswith("zmu_") is False:
                idc.set_name(ea, "zmu_" + name)

        return 1

    def update(self, ctx):
        return idaapi.AST_ENABLE_ALWAYS


class zelosoverlay_t(idaapi.plugin_t):  # pragma: no cover
    """
    Adds a Zelos {View} menu option for loading an overlay.
    """

    flags = 0
    comment = "Load an overlay file generated by Zelos."
    help = comment
    wanted_name = "ZelosOverlay"
    wanted_hotkey = ""
    menu_name = "View/"
    menu_context = []

    def init(self):
        zelos_overlay_action = idaapi.action_desc_t(
            "zelosoverlay:action",
            "Load Zelos Overlay...",
            ApplyZelosOverlay(),
            "",
            "Load Zelos Overlay...",
            199,
        )

        idaapi.register_action(zelos_overlay_action)
        idaapi.attach_action_to_menu(
            "View/", "zelosoverlay:action", idaapi.SETMENU_APP
        )

        return idaapi.PLUGIN_KEEP

    def term(self):
        pass

    def run(self, arg):
        pass


def PLUGIN_ENTRY():  # pragma: no cover
    return zelosoverlay_t()


repository: merydwin/idascrtipt
file: examples/ex_prefix_plugin.py
wanted_name: user defined prefix
comment: This is a user defined prefix sample plugin
created_at: 2015-06-25 13:32:18+00:00
pushed_at: 2015-06-25 13:33:48+00:00
url:
https://github.com/merydwin/idascrtipt/blob/431e04847e55adbb1d263aa2aadc2d489d068f50/examples/ex_prefix_plugin.py

content:
import idaapi

PREFIX = idaapi.SCOLOR_INV + ' ' + idaapi.SCOLOR_INV

class prefix_plugin_t(idaapi.plugin_t):
    flags = 0
    comment = "This is a user defined prefix sample plugin"
    help = "This is help"
    wanted_name = "user defined prefix"
    wanted_hotkey = ""


    def user_prefix(self, ea, lnnum, indent, line, bufsize):
        #print("ea=%x lnnum=%d indent=%d line=%s bufsize=%d" % (ea, lnnum, indent, line, bufsize))

        if (ea % 2 == 0) and indent == -1:
            return PREFIX
        else:
            return ""


    def init(self):
        self.prefix_installed = idaapi.set_user_defined_prefix(8, self.user_prefix)
        if self.prefix_installed:
            print("prefix installed")

        return idaapi.PLUGIN_KEEP


    def run(self, arg):
        pass


    def term(self):
        if self.prefix_installed:
            idaapi.set_user_defined_prefix(0, None)
            print("prefix uninstalled!")


def PLUGIN_ENTRY():
    return prefix_plugin_t()



repository: mxmssh/idapython
file: examples/ex_prefix_plugin.py
description: Automatically exported from code.google.com/p/idapython
wanted_name: user defined prefix
comment: This is a user defined prefix sample plugin
created_at: 2015-04-10 06:53:38+00:00
pushed_at: 2015-04-10 06:56:13+00:00
url:
https://github.com/mxmssh/idapython/blob/081b988a03b88867786ad4131269db6930637a5b/examples/ex_prefix_plugin.py

content:
import idaapi

PREFIX = idaapi.SCOLOR_INV + ' ' + idaapi.SCOLOR_INV

class prefix_plugin_t(idaapi.plugin_t):
    flags = 0
    comment = "This is a user defined prefix sample plugin"
    help = "This is help"
    wanted_name = "user defined prefix"
    wanted_hotkey = ""


    def user_prefix(self, ea, lnnum, indent, line, bufsize):
        #print("ea=%x lnnum=%d indent=%d line=%s bufsize=%d" % (ea, lnnum, indent, line, bufsize))

        if (ea % 2 == 0) and indent == -1:
            return PREFIX
        else:
            return ""


    def init(self):
        self.prefix_installed = idaapi.set_user_defined_prefix(8, self.user_prefix)
        if self.prefix_installed:
            print("prefix installed")

        return idaapi.PLUGIN_KEEP


    def run(self, arg):
        pass


    def term(self):
        if self.prefix_installed:
            idaapi.set_user_defined_prefix(0, None)
            print("prefix uninstalled!")


def PLUGIN_ENTRY():
    return prefix_plugin_t()



repository: hoyori/idapython
file: examples/ex_prefix_plugin.py
description: Automatically exported from code.google.com/p/idapython
wanted_name: user defined prefix
comment: This is a user defined prefix sample plugin
created_at: 2015-04-04 07:26:57+00:00
pushed_at: 2015-04-04 07:30:32+00:00
url:
https://github.com/hoyori/idapython/blob/081b988a03b88867786ad4131269db6930637a5b/examples/ex_prefix_plugin.py


repository: Hehouhua/idapython
file: examples/ex_prefix_plugin.py
description: Automatically exported from code.google.com/p/idapython
wanted_name: user defined prefix
comment: This is a user defined prefix sample plugin
created_at: 2016-04-08 08:07:27+00:00
pushed_at: 2016-04-08 08:10:01+00:00
url:
https://github.com/Hehouhua/idapython/blob/518dc295c8a9747834ddbe19566c2d2924d8ad01/examples/ex_prefix_plugin.py


repository: malefs/security-smell-detector-python-gist
file: gist-src/eeea2093888e8d4004ec06b5a1dede1e.py
wanted_name: CallsHintsPlugin
comment: Display the calls and strings referenced by a function as hints.
created_at: 2019-11-23 19:14:08+00:00
pushed_at: 2020-07-26 03:38:04+00:00
url:
https://github.com/malefs/security-smell-detector-python-gist/blob/e90764deb06ae4d3c45e702db7ad00351520348f/gist-src/eeea2093888e8d4004ec06b5a1dede1e.py

content:
'''
IDA plugin to display the calls and strings referenced by a function as hints.

Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils


###############################################################################
#### begin: idapython_lex_curline
# via: https://gist.github.com/williballenthin/466eb28679d30e212ffac57e4a9ceaa5
# note: inline here for simplicity


# inverse mapping of color value to name.
# ref: https://www.hex-rays.com/products/ida/support/sdkdoc/group___s_c_o_l_o_r__.html#ga6052470f86411b8b5ffdf4af4bbee225
INV_COLORS = {
    0x1: 'COLOR_DEFAULT',  #= 0x01,         // Default
    0x2: 'COLOR_REGCMT',   #= 0x02,         // Regular comment
    0x3: 'COLOR_RPTCMT',   #= 0x03,         // Repeatable comment (comment defined somewhere else)
    0x4: 'COLOR_AUTOCMT',  #= 0x04,         // Automatic comment
    0x5: 'COLOR_INSN',     #= 0x05,         // Instruction
    0x6: 'COLOR_DATNAME',  #= 0x06,         // Dummy Data Name
    0x7: 'COLOR_DNAME',    #= 0x07,         // Regular Data Name
    0x8: 'COLOR_DEMNAME',  #= 0x08,         // Demangled Name
    0x9: 'COLOR_SYMBOL',   #= 0x09,         // Punctuation
    0xa: 'COLOR_CHAR',     #= 0x0A,         // Char constant in instruction
    0xb: 'COLOR_STRING',   #= 0x0B,         // String constant in instruction
    0xc: 'COLOR_NUMBER',   #= 0x0C,         // Numeric constant in instruction
    0xd: 'COLOR_VOIDOP',   #= 0x0D,         // Void operand
    0xe: 'COLOR_CREF',     #= 0x0E,         // Code reference
    0xf: 'COLOR_DREF',     #= 0x0F,         // Data reference
    0x10: 'COLOR_CREFTAIL', #= 0x10,         // Code reference to tail byte
    0x11: 'COLOR_DREFTAIL', #= 0x11,         // Data reference to tail byte
    0x12: 'COLOR_ERROR',    #= 0x12,         // Error or problem
    0x13: 'COLOR_PREFIX',   #= 0x13,         // Line prefix
    0x14: 'COLOR_BINPREF',  #= 0x14,         // Binary line prefix bytes
    0x15: 'COLOR_EXTRA',    #= 0x15,         // Extra line
    0x16: 'COLOR_ALTOP',    #= 0x16,         // Alternative operand
    0x17: 'COLOR_HIDNAME',  #= 0x17,         // Hidden name
    0x18: 'COLOR_LIBNAME',  #= 0x18,         // Library function name
    0x19: 'COLOR_LOCNAME',  #= 0x19,         // Local variable name
    0x1A: 'COLOR_CODNAME',  #= 0x1A,         // Dummy code name
    0x1B: 'COLOR_ASMDIR',   #= 0x1B,         // Assembler directive
    0x1C: 'COLOR_MACRO',    #= 0x1C,         // Macro
    0x1D: 'COLOR_DSTR',     #= 0x1D,         // String constant in data directive
    0x1E: 'COLOR_DCHAR',    #= 0x1E,         // Char constant in data directive
    0x1F: 'COLOR_DNUM',     #= 0x1F,         // Numeric constant in data directive
    0x20: 'COLOR_KEYWORD',  #= 0x20,         // Keywords
    0x21: 'COLOR_REG',      #= 0x21,         // Register name
    0x22: 'COLOR_IMPNAME',  #= 0x22,         // Imported name
    0x23: 'COLOR_SEGNAME',  #= 0x23,         // Segment name
    0x24: 'COLOR_UNKNAME',  #= 0x24,         // Dummy unknown name
    0x25: 'COLOR_CNAME',    #= 0x25,         // Regular code name
    0x26: 'COLOR_UNAME',    #= 0x26,         // Regular unknown name
    0x27: 'COLOR_COLLAPSED',#= 0x27,         // Collapsed line

    #  // Fictive colors
    0x28: 'COLOR_ADDR',     #= 0x28, // hidden address marks
                            #        // The address is represented as 8digit
                            #        // hex number: 01234567
                            #        // It doesn't have COLOR_OFF pair
                            #        // NB: for 64-bit IDA, the address is 16digit

    0x29: 'COLOR_OPND1',    #= COLOR_ADDR+1, // Instruction operand 1
    0x2A: 'COLOR_OPND2',    #= COLOR_ADDR+2, // Instruction operand 2
    0x2B: 'COLOR_OPND3',    #= COLOR_ADDR+3, // Instruction operand 3
    0x2C: 'COLOR_OPND4',    #= COLOR_ADDR+4, // Instruction operand 4
    0x2D: 'COLOR_OPND5',    #= COLOR_ADDR+5, // Instruction operand 5
    0x2E: 'COLOR_OPND6',    #= COLOR_ADDR+6, // Instruction operand 6

    0x32: 'COLOR_UTF8',     #= COLOR_ADDR+10;// Following text is UTF-8 encoded
}


class Symbol(object):
    def __init__(self, type):
        super(Symbol, self).__init__()
        self.type = type

    def __str__(self):
        raise NotImplementedError()


class StringSymbol(Symbol):
    def __init__(self, string):
        super(StringSymbol, self).__init__('string')
        self.string = string

    def __str__(self):
        return 'STRING=' + self.string


class ColorOnSymbol(Symbol):
    def __init__(self, color):
        super(ColorOnSymbol, self).__init__('coloron')
        self.color = ord(color)

    def __str__(self):
        return 'COLORON=' + INV_COLORS[self.color]


class ColorOffSymbol(Symbol):
    def __init__(self, color):
        super(ColorOffSymbol, self).__init__('coloroff')
        self.color = ord(color)

    def __str__(self):
        return 'COLOROFF=' + INV_COLORS[self.color]


class ColorInvSymbol(Symbol):
    def __init__(self):
        super(ColorInvSymbol, self).__init__('colorinv')

    def __str__(self):
        return 'COLORINV'



def lex(curline):
    '''
    split the line returned by `get_custom_viewer_curline` into symbols.
    it pulls out the strings, color directives, and escaped characters.
    
    Args:
      curline (str): a line returned by `idaapi.get_custom_viewer_curline`
    
    Returns:
      generator: generator of Symbol subclass instances
    '''

    offset = 0
    cur_word = []
    while offset < len(curline):

        c = curline[offset]

        if c == idaapi.COLOR_ON:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            color = curline[offset]

            yield ColorOnSymbol(color)
            offset += 1

        elif c == idaapi.COLOR_OFF:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            color = curline[offset]

            yield ColorOffSymbol(color)
            offset += 1

        elif c == idaapi.COLOR_ESC:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            c = curline[offset]

            cur_word.append(c)
            offset += 1

        elif c == idaapi.COLOR_INV:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            yield ColorInvSymbol()
            offset += 1

        else:
            cur_word.append(c)
            offset += 1


def get_color_at_char(curline, index):
    curlen = 0
    curcolor = 0
    for sym in lex(curline):
        if sym.type == 'string':
            curlen += len(sym.string)
            if curlen >= index:
                return curcolor
        elif sym.type == 'coloron':
            curcolor = sym.color
        elif sym.type == 'coloroff':
            curcolor = 0
        else:
            curcolor = 0

    return curcolor


def get_token_at_char(curline, index):
    curlen = 0
    curcolor = 0
    for sym in lex(curline):
        if sym.type == 'string':
            curlen += len(sym.string)
            if curlen >= index:
                return sym.string
        else:
            continue

    return ''


#### end: idapython_lex_curline
###############################################################################



def enum_function_addrs(fva):
    '''
    yield the effective addresses of each instruction in the given function.
    these addresses are not guaranteed to be in any order.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[int]: the addresses of each instruction
    '''
    f = idaapi.get_func(fva)
    if not f:
        raise ValueError('not a function')

    for block in idaapi.FlowChart(f):
        ea = block.startEA
        while ea <= block.endEA:
            yield ea
            ea = idc.NextHead(ea)


def enum_calls_in_function(fva):
    '''
    yield the call instructions in the given function.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[tuple[int, str]]: the address of a call instruction, and the disassembly line at that address
    '''
    for ea in enum_function_addrs(fva):
        if idc.GetMnem(ea) != 'call':
            continue

        disasm = idc.GetDisasm(ea)

        yield ea, disasm


def enum_string_refs_in_function(fva):
    '''
    yield the string references in the given function.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[tuple[int, int, str]]: tuples of metadata, including:
       - the address of the instruction referencing a string
       - the address of the string
       - the string
    '''
    for ea in enum_function_addrs(fva):
        for ref in idautils.DataRefsFrom(ea):
            stype = idc.GetStringType(ref)
            if stype < 0 or stype > 7:
                continue

            CALC_MAX_LEN = -1
            s = str(idc.GetString(ref, CALC_MAX_LEN, stype))

            yield ea, ref, s


def uniq(s):
    '''
    yield the unique items in the given sequence.
    only provide the first copy encountered, skipping subsequent copies.
    
    Args:
      s (sequence[T]): a sequence of things

    Returns:
      sequence[T]: a sequence of the unique copies
    '''
    seen = set([])

    for item in s:
        if item in seen:
            continue

        yield item

        seen.add(item)


def render_function_hint(fva):
    '''
    create a textual report for the call and string references in the given function.
    
    eg.

        3 calls, 4 strings

        calls:
          - call     new
          - call     gethostbyname
          - call     delete
    
        strings:
          - www.google.com
          - www.bing.com
          - www.yahoo.com
          - www.cnn.com
    
    Args:
      fva (int): the starting address of a function

    Returns:
      str: the report
    '''
    ret = []

    # use `uniq` here (vs using a set) cause we want to maintain *some* semblance of order.
    calls = list(uniq(d for f, d in enum_calls_in_function(fva)))
    strings = list(uniq(s for o, r, s in enum_string_refs_in_function(fva)))

    # this would be a good place to use Jinja2 templating,
    #  but lets not require that external dependency
    ret.append('%d calls, %s strings' % (len(calls), len(strings)))

    ret.append('')
    ret.append('calls:')
    for call in calls:
        ret.append('  - ' + call)
    if not calls:
        ret.append('  (none)')

    ret.append('')
    ret.append('strings:')
    for string in strings:
        ret.append('  - ' + string)
    if not strings:
        ret.append('  (none)')

    return str('\n'.join(ret))


class CallsHintsHook(idaapi.UI_Hooks):
    def get_custom_viewer_hint(self, view, place):
        try:
            tform = idaapi.get_current_tform()
            if idaapi.get_tform_type(tform) != idaapi.BWN_DISASM:
                return None

            curline = idaapi.get_custom_viewer_curline(view, True)
            _, x, y = idaapi.get_custom_viewer_place(view, True)
            ea = place.toea()

            # "color" is a bit of misnomer: its the type of the symbol currently hinted
            color = get_color_at_char(curline, x)
            if color != idaapi.COLOR_ADDR:
                return None

            # for COLOR_ADDR tokens, we get something like:
            #   401000sub_401000
            # so we will need to prune the address from the start before we can use it :-(
            token = get_token_at_char(curline, x)

            # enumerate the operands of the instruction at this address
            # and search the token for the operand text
            func_name = None
            for i in range(3):
                o = idc.GetOpnd(ea, i)
                if not o:
                    break

                # if we have `offset sub_401000`, we want: `sub_401000`
                if ' ' in o:
                    o = o.partition(' ')[2]

                if o in token:
                    func_name = o
                    break

            if not func_name:
                return None

            # get the address given the function name
            fva = idc.LocByName(func_name)
            if not fva:
                return None

            # ensure its actually a function
            if not idaapi.get_func(fva):
                return None

            # this magic constant "1" is the number of "important lines" to display by default.
            # the remaining lines get shown if you scroll down while the hint is displayed, revealing more lines.
            return render_function_hint(fva), 1
        except Exception as e:
            print('CallsHintsPlugin: error: %s. Get in touch with @williballenthin.' % (str(e)))
            return None


class CallsHintsPlugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_KEEP
    comment = 'Display the calls and strings referenced by a function as hints.'
    help = 'Display the calls and strings referenced by a function as hints.'
    wanted_name = "CallsHintsPlugin"
    wanted_hotkey = "Ctrl-'"

    def init(self):
        self.hooks = CallsHintsHook()
        return idaapi.PLUGIN_OK

    def run(self, arg):
        print('CallsHintsPlugin: run')
        self.hooks.hook()

    def term(self):
        print('CallsHintsPlugin: term')
        self.hooks.unhook()


def PLUGIN_ENTRY():
    return CallsHintsPlugin()


repository: malefs/security-smell-detector-python-gist
file: gist-hash/eeea2093888e8d4004ec06b5a1dede1e/snippet.py
wanted_name: CallsHintsPlugin
comment: Display the calls and strings referenced by a function as hints.
created_at: 2019-11-23 19:14:08+00:00
pushed_at: 2020-07-26 03:38:04+00:00
url:
https://github.com/malefs/security-smell-detector-python-gist/blob/e90764deb06ae4d3c45e702db7ad00351520348f/gist-hash/eeea2093888e8d4004ec06b5a1dede1e/snippet.py

content:
'''
IDA plugin to display the calls and strings referenced by a function as hints.

Installation: put this file in your %IDADIR%/plugins/ directory.
Author: Willi Ballenthin <william.ballenthin@fireeye.com>
Licence: Apache 2.0
'''
import idc
import idaapi
import idautils


###############################################################################
#### begin: idapython_lex_curline
# via: https://gist.github.com/williballenthin/466eb28679d30e212ffac57e4a9ceaa5
# note: inline here for simplicity


# inverse mapping of color value to name.
# ref: https://www.hex-rays.com/products/ida/support/sdkdoc/group___s_c_o_l_o_r__.html#ga6052470f86411b8b5ffdf4af4bbee225
INV_COLORS = {
    0x1: 'COLOR_DEFAULT',  #= 0x01,         // Default
    0x2: 'COLOR_REGCMT',   #= 0x02,         // Regular comment
    0x3: 'COLOR_RPTCMT',   #= 0x03,         // Repeatable comment (comment defined somewhere else)
    0x4: 'COLOR_AUTOCMT',  #= 0x04,         // Automatic comment
    0x5: 'COLOR_INSN',     #= 0x05,         // Instruction
    0x6: 'COLOR_DATNAME',  #= 0x06,         // Dummy Data Name
    0x7: 'COLOR_DNAME',    #= 0x07,         // Regular Data Name
    0x8: 'COLOR_DEMNAME',  #= 0x08,         // Demangled Name
    0x9: 'COLOR_SYMBOL',   #= 0x09,         // Punctuation
    0xa: 'COLOR_CHAR',     #= 0x0A,         // Char constant in instruction
    0xb: 'COLOR_STRING',   #= 0x0B,         // String constant in instruction
    0xc: 'COLOR_NUMBER',   #= 0x0C,         // Numeric constant in instruction
    0xd: 'COLOR_VOIDOP',   #= 0x0D,         // Void operand
    0xe: 'COLOR_CREF',     #= 0x0E,         // Code reference
    0xf: 'COLOR_DREF',     #= 0x0F,         // Data reference
    0x10: 'COLOR_CREFTAIL', #= 0x10,         // Code reference to tail byte
    0x11: 'COLOR_DREFTAIL', #= 0x11,         // Data reference to tail byte
    0x12: 'COLOR_ERROR',    #= 0x12,         // Error or problem
    0x13: 'COLOR_PREFIX',   #= 0x13,         // Line prefix
    0x14: 'COLOR_BINPREF',  #= 0x14,         // Binary line prefix bytes
    0x15: 'COLOR_EXTRA',    #= 0x15,         // Extra line
    0x16: 'COLOR_ALTOP',    #= 0x16,         // Alternative operand
    0x17: 'COLOR_HIDNAME',  #= 0x17,         // Hidden name
    0x18: 'COLOR_LIBNAME',  #= 0x18,         // Library function name
    0x19: 'COLOR_LOCNAME',  #= 0x19,         // Local variable name
    0x1A: 'COLOR_CODNAME',  #= 0x1A,         // Dummy code name
    0x1B: 'COLOR_ASMDIR',   #= 0x1B,         // Assembler directive
    0x1C: 'COLOR_MACRO',    #= 0x1C,         // Macro
    0x1D: 'COLOR_DSTR',     #= 0x1D,         // String constant in data directive
    0x1E: 'COLOR_DCHAR',    #= 0x1E,         // Char constant in data directive
    0x1F: 'COLOR_DNUM',     #= 0x1F,         // Numeric constant in data directive
    0x20: 'COLOR_KEYWORD',  #= 0x20,         // Keywords
    0x21: 'COLOR_REG',      #= 0x21,         // Register name
    0x22: 'COLOR_IMPNAME',  #= 0x22,         // Imported name
    0x23: 'COLOR_SEGNAME',  #= 0x23,         // Segment name
    0x24: 'COLOR_UNKNAME',  #= 0x24,         // Dummy unknown name
    0x25: 'COLOR_CNAME',    #= 0x25,         // Regular code name
    0x26: 'COLOR_UNAME',    #= 0x26,         // Regular unknown name
    0x27: 'COLOR_COLLAPSED',#= 0x27,         // Collapsed line

    #  // Fictive colors
    0x28: 'COLOR_ADDR',     #= 0x28, // hidden address marks
                            #        // The address is represented as 8digit
                            #        // hex number: 01234567
                            #        // It doesn't have COLOR_OFF pair
                            #        // NB: for 64-bit IDA, the address is 16digit

    0x29: 'COLOR_OPND1',    #= COLOR_ADDR+1, // Instruction operand 1
    0x2A: 'COLOR_OPND2',    #= COLOR_ADDR+2, // Instruction operand 2
    0x2B: 'COLOR_OPND3',    #= COLOR_ADDR+3, // Instruction operand 3
    0x2C: 'COLOR_OPND4',    #= COLOR_ADDR+4, // Instruction operand 4
    0x2D: 'COLOR_OPND5',    #= COLOR_ADDR+5, // Instruction operand 5
    0x2E: 'COLOR_OPND6',    #= COLOR_ADDR+6, // Instruction operand 6

    0x32: 'COLOR_UTF8',     #= COLOR_ADDR+10;// Following text is UTF-8 encoded
}


class Symbol(object):
    def __init__(self, type):
        super(Symbol, self).__init__()
        self.type = type

    def __str__(self):
        raise NotImplementedError()


class StringSymbol(Symbol):
    def __init__(self, string):
        super(StringSymbol, self).__init__('string')
        self.string = string

    def __str__(self):
        return 'STRING=' + self.string


class ColorOnSymbol(Symbol):
    def __init__(self, color):
        super(ColorOnSymbol, self).__init__('coloron')
        self.color = ord(color)

    def __str__(self):
        return 'COLORON=' + INV_COLORS[self.color]


class ColorOffSymbol(Symbol):
    def __init__(self, color):
        super(ColorOffSymbol, self).__init__('coloroff')
        self.color = ord(color)

    def __str__(self):
        return 'COLOROFF=' + INV_COLORS[self.color]


class ColorInvSymbol(Symbol):
    def __init__(self):
        super(ColorInvSymbol, self).__init__('colorinv')

    def __str__(self):
        return 'COLORINV'



def lex(curline):
    '''
    split the line returned by `get_custom_viewer_curline` into symbols.
    it pulls out the strings, color directives, and escaped characters.
    
    Args:
      curline (str): a line returned by `idaapi.get_custom_viewer_curline`
    
    Returns:
      generator: generator of Symbol subclass instances
    '''

    offset = 0
    cur_word = []
    while offset < len(curline):

        c = curline[offset]

        if c == idaapi.COLOR_ON:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            color = curline[offset]

            yield ColorOnSymbol(color)
            offset += 1

        elif c == idaapi.COLOR_OFF:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            color = curline[offset]

            yield ColorOffSymbol(color)
            offset += 1

        elif c == idaapi.COLOR_ESC:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            offset += 1
            c = curline[offset]

            cur_word.append(c)
            offset += 1

        elif c == idaapi.COLOR_INV:
            if cur_word:
                yield StringSymbol(''.join(cur_word))
                cur_word = []

            yield ColorInvSymbol()
            offset += 1

        else:
            cur_word.append(c)
            offset += 1


def get_color_at_char(curline, index):
    curlen = 0
    curcolor = 0
    for sym in lex(curline):
        if sym.type == 'string':
            curlen += len(sym.string)
            if curlen >= index:
                return curcolor
        elif sym.type == 'coloron':
            curcolor = sym.color
        elif sym.type == 'coloroff':
            curcolor = 0
        else:
            curcolor = 0

    return curcolor


def get_token_at_char(curline, index):
    curlen = 0
    curcolor = 0
    for sym in lex(curline):
        if sym.type == 'string':
            curlen += len(sym.string)
            if curlen >= index:
                return sym.string
        else:
            continue

    return ''


#### end: idapython_lex_curline
###############################################################################



def enum_function_addrs(fva):
    '''
    yield the effective addresses of each instruction in the given function.
    these addresses are not guaranteed to be in any order.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[int]: the addresses of each instruction
    '''
    f = idaapi.get_func(fva)
    if not f:
        raise ValueError('not a function')

    for block in idaapi.FlowChart(f):
        ea = block.startEA
        while ea <= block.endEA:
            yield ea
            ea = idc.NextHead(ea)


def enum_calls_in_function(fva):
    '''
    yield the call instructions in the given function.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[tuple[int, str]]: the address of a call instruction, and the disassembly line at that address
    '''
    for ea in enum_function_addrs(fva):
        if idc.GetMnem(ea) != 'call':
            continue

        disasm = idc.GetDisasm(ea)

        yield ea, disasm


def enum_string_refs_in_function(fva):
    '''
    yield the string references in the given function.
    
    Args:
      fva (int): the starting address of a function
    
    Returns:
      sequence[tuple[int, int, str]]: tuples of metadata, including:
       - the address of the instruction referencing a string
       - the address of the string
       - the string
    '''
    for ea in enum_function_addrs(fva):
        for ref in idautils.DataRefsFrom(ea):
            stype = idc.GetStringType(ref)
            if stype < 0 or stype > 7:
                continue

            CALC_MAX_LEN = -1
            s = str(idc.GetString(ref, CALC_MAX_LEN, stype))

            yield ea, ref, s


def uniq(s):
    '''
    yield the unique items in the given sequence.
    only provide the first copy encountered, skipping subsequent copies.
    
    Args:
      s (sequence[T]): a sequence of things

    Returns:
      sequence[T]: a sequence of the unique copies
    '''
    seen = set([])

    for item in s:
        if item in seen:
            continue

        yield item

        seen.add(item)


def render_function_hint(fva):
    '''
    create a textual report for the call and string references in the given function.
    
    eg.

        3 calls, 4 strings

        calls:
          - call     new
          - call     gethostbyname
          - call     delete
    
        strings:
          - www.google.com
          - www.bing.com
          - www.yahoo.com
          - www.cnn.com
    
    Args:
      fva (int): the starting address of a function

    Returns:
      str: the report
    '''
    ret = []

    # use `uniq` here (vs using a set) cause we want to maintain *some* semblance of order.
    calls = list(uniq(d for f, d in enum_calls_in_function(fva)))
    strings = list(uniq(s for o, r, s in enum_string_refs_in_function(fva)))

    # this would be a good place to use Jinja2 templating,
    #  but lets not require that external dependency
    ret.append('%d calls, %s strings' % (len(calls), len(strings)))

    ret.append('')
    ret.append('calls:')
    for call in calls:
        ret.append('  - ' + call)
    if not calls:
        ret.append('  (none)')

    ret.append('')
    ret.append('strings:')
    for string in strings:
        ret.append('  - ' + string)
    if not strings:
        ret.append('  (none)')

    return str('\n'.join(ret))


class CallsHintsHook(idaapi.UI_Hooks):
    def get_custom_viewer_hint(self, view, place):
        try:
            tform = idaapi.get_current_tform()
            if idaapi.get_tform_type(tform) != idaapi.BWN_DISASM:
                return None

            curline = idaapi.get_custom_viewer_curline(view, True)
            _, x, y = idaapi.get_custom_viewer_place(view, True)
            ea = place.toea()

            # "color" is a bit of misnomer: its the type of the symbol currently hinted
            color = get_color_at_char(curline, x)
            if color != idaapi.COLOR_ADDR:
                return None

            # for COLOR_ADDR tokens, we get something like:
            #   401000sub_401000
            # so we will need to prune the address from the start before we can use it :-(
            token = get_token_at_char(curline, x)

            # enumerate the operands of the instruction at this address
            # and search the token for the operand text
            func_name = None
            for i in range(3):
                o = idc.GetOpnd(ea, i)
                if not o:
                    break

                # if we have `offset sub_401000`, we want: `sub_401000`
                if ' ' in o:
                    o = o.partition(' ')[2]

                if o in token:
                    func_name = o
                    break

            if not func_name:
                return None

            # get the address given the function name
            fva = idc.LocByName(func_name)
            if not fva:
                return None

            # ensure its actually a function
            if not idaapi.get_func(fva):
                return None

            # this magic constant "1" is the number of "important lines" to display by default.
            # the remaining lines get shown if you scroll down while the hint is displayed, revealing more lines.
            return render_function_hint(fva), 1
        except Exception as e:
            print('CallsHintsPlugin: error: %s. Get in touch with @williballenthin.' % (str(e)))
            return None


class CallsHintsPlugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_KEEP
    comment = 'Display the calls and strings referenced by a function as hints.'
    help = 'Display the calls and strings referenced by a function as hints.'
    wanted_name = "CallsHintsPlugin"
    wanted_hotkey = "Ctrl-'"

    def init(self):
        self.hooks = CallsHintsHook()
        return idaapi.PLUGIN_OK

    def run(self, arg):
        print('CallsHintsPlugin: run')
        self.hooks.hook()

    def term(self):
        print('CallsHintsPlugin: term')
        self.hooks.unhook()


def PLUGIN_ENTRY():
    return CallsHintsPlugin()


repository: PyEGo/exp-gist
file: hard-gists-me/eeea2093888e8d4004ec06b5a1dede1e/snippet.py
description: Experiment results on hard-gists dataset
wanted_name: CallsHintsPlugin
comment: Display the calls and strings referenced by a function as hints.
created_at: 2021-04-18 11:16:06+00:00
pushed_at: 2022-11-18 17:22:11+00:00
url:
https://github.com/PyEGo/exp-gist/blob/bb8212e435ab525bb8ebdee2f620f850133a9b99/hard-gists-me/eeea2093888e8d4004ec06b5a1dede1e/snippet.py


repository: PyEGo/exp-gist
file: hard-gists-reqs/eeea2093888e8d4004ec06b5a1dede1e/snippet.py
description: Experiment results on hard-gists dataset
wanted_name: CallsHintsPlugin
comment: Display the calls and strings referenced by a function as hints.
created_at: 2021-04-18 11:16:06+00:00
pushed_at: 2022-11-18 17:22:11+00:00
url:
https://github.com/PyEGo/exp-gist/blob/bb8212e435ab525bb8ebdee2f620f850133a9b99/hard-gists-reqs/eeea2093888e8d4004ec06b5a1dede1e/snippet.py


repository: joxeankoret/diaphora
file: extras/diaphora_local.py
description: Diaphora, the most advanced Free and Open Source program diffing tool.
wanted_name: Diaphora: Diff Local Function
comment: Locally diff functions
created_at: 2015-03-20 02:12:26+00:00
pushed_at: 2024-11-24 08:49:59+00:00
url:
https://github.com/joxeankoret/diaphora/blob/d8b898e35750d103cb6a15f7a87910ff6b237427/extras/diaphora_local.py

content:
#!/usr/bin/python3

"""
Diaphora, a binary diffing tool
Copyright (c) 2015-2024, Joxean Koret

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
"""

import re
import os
import sys
import time
import difflib

import idc
import idaapi
import idautils

from PyQt5 import QtWidgets
from pygments import highlight
from pygments.formatters import HtmlFormatter
from pygments.lexers import NasmLexer, CppLexer, DiffLexer

#-------------------------------------------------------------------------------
DIFF_COLOR_ADDED      = "#aaffaa"
DIFF_COLOR_CHANGED    = "#ffff77"
DIFF_COLOR_SUBTRACTED = "#ffaaaa"
DIFF_COLOR_LINE_NO    = "#e0e0e0"

#-------------------------------------------------------------------------------
def log(msg):
  idaapi.msg(f"[{time.asctime()}] {msg}")

#-------------------------------------------------------------------------------
def do_decompile(f):
  return idaapi.decompile(f, flags=idaapi.DECOMP_NO_WAIT)

#-------------------------------------------------------------------------------
class CHtmlDiff:
  """A replacement for difflib.HtmlDiff that tries to enforce a max width

  The main challenge is to do this given QTextBrowser's limitations. In
  particular, QTextBrowser only implements a minimum of CSS.
  """

  _html_template = """
  <html>
  <head>
  <style>%(style)s</style>
  </head>
  <body>
  <table class="diff_tab" cellspacing=0>
  %(rows)s
  </table>
  </body>
  </html>
  """

  _style = (
    """
  table.diff_tab {
  font-family: Courier, monospace;
  table-layout: fixed;
  width: 100%;
  }

  .diff_add {
  background-color: """
    + DIFF_COLOR_ADDED
    + """;
  }
  .diff_chg {
  background-color: """
    + DIFF_COLOR_CHANGED
    + """;
  }
  .diff_sub {
  background-color: """
    + DIFF_COLOR_SUBTRACTED
    + """;
  }
  .diff_lineno {
  text-align: right;
  background-color: """
    + DIFF_COLOR_LINE_NO
    + """;
  }
  """
  )

  _row_template = """
  <tr>
    <td class="diff_lineno" width="auto">%s</td>
    <td class="diff_play" nowrap width="45%%">%s</td>
    <td class="diff_lineno" width="auto">%s</td>
    <td class="diff_play" nowrap width="45%%">%s</td>
  </tr>
  """

  _rexp_too_much_space = re.compile("^\t[.\\w]+ {8}")

  def make_file(self, lhs, rhs, fmt, lex):
    rows = []
    for left, right, changed in difflib._mdiff(lhs, rhs):
      lno, ltxt = left
      rno, rtxt = right

      if not changed:
        ltxt = highlight(ltxt, lex, fmt)
        rtxt = highlight(rtxt, lex, fmt)
      else:
        ltxt = self._stop_wasting_space(ltxt)
        rtxt = self._stop_wasting_space(rtxt)

        ltxt = ltxt.replace(" ", "&nbsp;")
        rtxt = rtxt.replace(" ", "&nbsp;")
        ltxt = ltxt.replace("<", "&lt;")
        ltxt = ltxt.replace(">", "&gt;")
        rtxt = rtxt.replace("<", "&lt;")
        rtxt = rtxt.replace(">", "&gt;")

      row = self._row_template % (str(lno), ltxt, str(rno), rtxt)
      rows.append(row)

    all_the_rows = "\n".join(rows)
    all_the_rows = (
      all_the_rows.replace("\x00+", '<span class="diff_add">')
      .replace("\x00-", '<span class="diff_sub">')
      .replace("\x00^", '<span class="diff_chg">')
      .replace("\x01", "</span>")
      .replace("\t", 4 * "&nbsp;")
    )

    res = self._html_template % {"style": self._style, "rows": all_the_rows}
    return res

  def _stop_wasting_space(self, s):
    """I never understood why you'd want to have 13 spaces between instruction and args'"""
    m = self._rexp_too_much_space.search(s)
    if m:
      mlen = len(m.group(0))
      return s[: mlen - 4] + s[mlen:]
    else:
      return s

#-------------------------------------------------------------------------------
class CHtmlViewer(idaapi.PluginForm):
  """
  Class used to graphically show the differences.
  """

  def OnCreate(self, form):
    self.parent = self.FormToPyQtWidget(form)
    self.PopulateForm()

    self.browser = None
    self.layout = None
    return 1

  def PopulateForm(self):
    self.layout = QtWidgets.QVBoxLayout()
    self.browser = QtWidgets.QTextBrowser()
    self.browser.setLineWrapMode(QtWidgets.QTextEdit.FixedColumnWidth)
    self.browser.setLineWrapColumnOrWidth(150)
    self.browser.setHtml(self.text)
    self.browser.setReadOnly(True)
    self.layout.addWidget(self.browser)
    self.parent.setLayout(self.layout)

  def Show(self, text, title):
    self.text = text
    return idaapi.PluginForm.Show(self, title)

#-------------------------------------------------------------------------------
def decompile_and_get(ea):
  decompiler_plugin = os.getenv("DIAPHORA_DECOMPILER_PLUGIN")
  if decompiler_plugin is None:
    decompiler_plugin = "hexrays"
  if not idaapi.init_hexrays_plugin() and not (
    load_plugin(decompiler_plugin) and idaapi.init_hexrays_plugin()
  ):
    return False

  f = idaapi.get_func(ea)
  if f is None:
    return False

  cfunc = do_decompile(f)
  if cfunc is None:
    # Failed to decompile
    return False

  sv = cfunc.get_pseudocode()
  lines = []
  first_line = None
  for sline in sv:
    line = idaapi.tag_remove(sline.line)
    if line.startswith("//"):
      continue

    if first_line is None:
      first_line = line
    else:
      lines.append(line)

  return first_line, "\n".join(lines)

#-------------------------------------------------------------------------------
def get_disasm(ea):
  mnem = idc.print_insn_mnem(ea)
  op1 = idc.print_operand(ea, 0)
  op2 = idc.print_operand(ea, 1)
  line = f"{mnem.ljust(8)} {op1}"
  if op2 != "":
    line += f", {op2}"
  return line

#-------------------------------------------------------------------------------
def get_assembly(ea):
  f = int(ea)
  func = idaapi.get_func(f)
  if not func:
    log("Cannot get a function object for 0x%x" % f)
    return False

  lines = []
  flow = idaapi.FlowChart(func)
  for block in flow:
    if block.end_ea == 0 or block.end_ea == idaapi.BADADDR:
      log("0x%08x: Skipping bad basic block" % f)
      continue

    if block.start_ea != func.start_ea:
      lines.append("loc_%08x:" % (block.start_ea))
    for head in idautils.Heads(block.start_ea, block.end_ea):
      lines.append("     %s" % (get_disasm(head)))

  return "\n".join(lines)

#-------------------------------------------------------------------------------
class CLocalDiffer:
  def __init__(self):
    pass

  def get_pseudo_diff_data(self, ea1, ea2):
    html_diff = CHtmlDiff()
    tmp = decompile_and_get(int(ea1))
    if not tmp:
      log("[i] Cannot get the pseudo-code for the current function")
      return False
    proto1, tmp1 = tmp
    buf1 = proto1 + "\n" + tmp1

    tmp = decompile_and_get(int(ea2))
    if not tmp:
      log("Cannot get the pseudo-code for the second function")
      return False
    proto2, tmp2 = tmp
    buf2 = proto2 + "\n" + tmp2

    if buf1 == buf2:
      warning("Both pseudo-codes are equal.")

    fmt = HtmlFormatter()
    fmt.noclasses = True
    fmt.linenos = False
    fmt.nobackground = True
    src = html_diff.make_file(
      buf1.split("\n"), buf2.split("\n"), fmt, CppLexer()
    )

    name1 = idaapi.get_func_name(int(ea1))
    name2 = idaapi.get_func_name(int(ea2))
    title = f'Diff pseudo-code {name1} - {name2}'
    res = (src, title)
    return res

  def get_asm_diff_data(self, ea1, ea2):
    html_diff = CHtmlDiff()
    asm1 = get_assembly(ea1)
    asm2 = get_assembly(ea2)
    name1 = idaapi.get_func_name(int(ea1))
    name2 = idaapi.get_func_name(int(ea2))
    buf1 = f'{name1} proc near\n{asm1}\n{name1} endp'
    buf2 = f'{name2} proc near\n{asm2}\n{name2} endp'

    fmt = HtmlFormatter()
    fmt.noclasses = True
    fmt.linenos = False
    fmt.nobackground = True
    src = html_diff.make_file(
      buf1.split("\n"), buf2.split("\n"), fmt, NasmLexer()
    )

    title = f"Diff assembly {name1} - {name2}"
    res = (src, title)
    return res

  def diff_pseudo(self, main_ea, diff_ea):
    res = self.get_pseudo_diff_data(main_ea, diff_ea)
    self.show_res(res)

  def diff_assembly(self, main_ea, diff_ea):
    res = self.get_asm_diff_data(main_ea, diff_ea)
    self.show_res(res)

  def show_res(self, res):
    if res:
      (src, title) = res
      cdiffer = CHtmlViewer()
      cdiffer.Show(src, title)

  def diff(self, main_ea, diff_ea):
    self.diff_assembly(main_ea, diff_ea)
    self.diff_pseudo(main_ea, diff_ea)

#-------------------------------------------------------------------------------
class myplugin_t(idaapi.plugin_t):
  flags = idaapi.PLUGIN_UNL
  comment = "Locally diff functions"
  help = "Tool to diff functions inside this database"
  wanted_name = "Diaphora: Diff Local Function"
  wanted_hotkey = "Ctrl+Shift+D"

  def init(self):
    return idaapi.PLUGIN_OK

  def run(self, arg):
    main()

  def term(self):
    pass

def PLUGIN_ENTRY():
  return myplugin_t()

#-------------------------------------------------------------------------------
def main():
  ea = idc.get_screen_ea()
  func = idaapi.get_func(ea)
  if func is None:
    warning("Please place the cursor over a function before calling this plugin.")
    return

  func_name = idaapi.get_func_name(ea)
  line = f"Select the function to diff {func_name} against"
  diff_ea = idc.choose_func(line)
  if diff_ea == idaapi.BADADDR:
    return

  log("Selected function address 0x%08x\n" % diff_ea)
  differ = CLocalDiffer()
  differ.diff(ea, diff_ea)

if __name__ == "__main__":
  main()


repository: mandiant/flare-ida
file: plugins/shellcode_hashes_search_plugin.py
description: IDA Pro utilities from FLARE team
wanted_name: Shellcode Hashes
comment: This is a comment
created_at: 2014-07-30 18:42:23+00:00
pushed_at: 2024-10-29 14:38:07+00:00
url:
https://github.com/mandiant/flare-ida/blob/fc667de6db279c6f8ec8bcc2f3eedff348db450f/plugins/shellcode_hashes_search_plugin.py

content:
#!/usr/bin/env python
# Jay Smith
# jay.smith@fireeye.com
# 
########################################################################
# Copyright 2012 Mandiant
# Copyright 2014 FireEye
# Copyright 2019 FireEye
#
# Mandiant licenses this file to you under the Apache License, Version
# 2.0 (the "License"); you may not use this file except in compliance with the
# License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied. See the License for the specific language governing
# permissions and limitations under the License.
########################################################################
#
# IDA Plugin wrapper for shellcode hash search.
#
########################################################################


import idc 
import idautils  
import idaapi

idaapi.require('flare')
idaapi.require('flare.shellcode_hash_search')

class shellcode_search_plugin_t(idaapi.plugin_t):
    flags = idaapi.PLUGIN_UNL
    comment = "This is a comment"

    help = "This is help"
    wanted_name = "Shellcode Hashes"
    wanted_hotkey = ""

    def init(self):
        return idaapi.PLUGIN_OK

    def run(self, arg):
        flare.shellcode_hash_search.main()

    def term(self):
        pass

def PLUGIN_ENTRY():
    return shellcode_search_plugin_t()


repository: idapython/src
file: examples/decompiler/vds19.py
description: IDAPython project for Hex-Ray's IDA Pro
wanted_name: optimize x|~x
created_at: 2015-03-14 20:09:27+00:00
pushed_at: 2025-03-13 15:18:11+00:00
url:
https://github.com/idapython/src/blob/af978e79e68af701c45bab401afce5145aa4b80b/examples/decompiler/vds19.py

content:
"""
summary: add a custom microcode instruction optimization rule

description:
  Installs a custom microcode instruction optimization rule,
  to transform:

      x | ~x

  into

      -1

  To see this plugin in action please use be_ornot_be.idb

level: advanced
"""

import ida_hexrays
import ida_idaapi

# recognize "x | ~x" and replace by -1
class subinsn_optimizer_t(ida_hexrays.minsn_visitor_t):
    cnt = 0
    def visit_minsn(self):      # for each instruction...
        ins = self.curins       # take a reference to the current instruction

        # THE CORE OF THE PLUGIN IS HERE:
        # check the pattern "x | ~x"
        if ins.opcode == ida_hexrays.m_or and ins.r.is_insn(ida_hexrays.m_bnot) and ins.l == ins.r.d.l:
            if not ins.l.has_side_effects(): # avoid destroying side effects
                # pattern matched, convert to "mov -1, ..."
                ins.opcode = ida_hexrays.m_mov
                ins.l.make_number(-1, ins.r.size)
                ins.r = ida_hexrays.mop_t()
                self.cnt = self.cnt + 1 # number of changes we made
        return 0 # continue traversal

# a custom instruction optimizer, boilerplate code
class sample_optimizer_t(ida_hexrays.optinsn_t):
    def func(self, blk, ins, optflags):
        opt = subinsn_optimizer_t()
        ins.for_all_insns(opt)
        if opt.cnt != 0:                # if we modified microcode,
            blk.mba.verify(True)        # run the verifier
        return opt.cnt                  # report the number of changes

# a plugin interface, boilerplate code
class my_plugin_t(ida_idaapi.plugin_t):
    flags = ida_idaapi.PLUGIN_HIDE
    wanted_name = "optimize x|~x"
    wanted_hotkey = ""
    comment = ""
    help = ""
    def init(self):
        if ida_hexrays.init_hexrays_plugin():
            self.optimizer = sample_optimizer_t()
            self.optimizer.install()
            print("Installed sample optimizer for 'x | ~x'")
            return ida_idaapi.PLUGIN_KEEP # keep us in the memory
    def term(self):
        self.optimizer.remove()
    def run(self, arg):
        if arg == 1:
            return self.optimizer.remove()
        elif arg == 2:
            return self.optimizer.install()

def PLUGIN_ENTRY():
    return my_plugin_t()


repository: tmr232/Sark
file: plugins/quick_copy.py
description: IDAPython Made Easy
url: https://github.com/tmr232/Sark/blob/950e2c17e520ab637a3cdcd0da312d224b951f13/plugins/quick_copy.py
wanted_name: Quick Copy
comment: Quickly copy addresses and instructions
created_at: 2015-01-19 09:13:48+00:00
pushed_at: 2025-02-22 10:17:16+00:00
content:
import idaapi
import clipboard
import sark
import binascii


def to_hex_bytes(raw_bytes: bytes) -> str:
    hex_string = binascii.b2a_hex(raw_bytes).decode('utf-8')
    hex_bytes = ' '.join(hex_string[i:i + 2] for i in range(0, len(hex_string), 2))
    return hex_bytes


def message(*messages):
    for msg in messages:
        for line in msg.splitlines():
            idaapi.msg("[QuickCopy] {}\n".format(line))


def copy_current_address():
    start, end = sark.get_selection()
    clipboard.copy("0x{:08X}".format(start))


def copy_current_file_offset():
    """Get the file-offset mapped to the current address."""
    start, end = sark.get_selection()

    try:
        file_offset = sark.core.get_fileregion_offset(start)
        clipboard.copy("0x{:08X}".format(file_offset))

    except sark.exceptions.NoFileOffset:
        message("The current address cannot be mapped to a valid offset of the input file.")


def copy_current_selection():
    start, end = sark.get_selection()
    buffer = sark.data.read_memory(start, end)
    clipboard.copy(to_hex_bytes(buffer))


class QuickCopy(idaapi.plugin_t):
    flags = 0
    comment = "Quickly copy addresses and instructions"
    help = "Quickly copy addresses and instructions"
    wanted_name = "Quick Copy"
    wanted_hotkey = ""

    def init(self):
        self.hotkeys = []
        self.hotkeys.append(idaapi.add_hotkey("Ctrl+Alt+C", copy_current_address))
        self.hotkeys.append(idaapi.add_hotkey("Ctrl+Alt+O", copy_current_file_offset))
        self.hotkeys.append(idaapi.add_hotkey("Ctrl+Shift+C", copy_current_selection))
        return idaapi.PLUGIN_KEEP

    def term(self):
        for hotkey in self.hotkeys:
            idaapi.del_hotkey(hotkey)

    def run(self, arg):
        pass


def PLUGIN_ENTRY():
    return QuickCopy()


repository: airbus-cert/comida
file: comida.py
description: An IDA Plugin that help analyzing module that use COM
url: https://github.com/airbus-cert/comida/blob/177ea45f98b153552dc13545dda64a6a26fab0a0/comida.py
wanted_name: ComIDA
created_at: 2020-02-07 15:09:53+00:00
pushed_at: 2023-07-27 09:01:02+00:00
content:
"""
This plugin is designed to target Malware analyst and Windows internal reverser

It try to find all reference of GUID by matching then with registry values
and list all references with function name to quickly navigate by COM references

Then if you have Hex-Rays plugin, it will infer type for result of 
* CoCreateInstance function
* CoGetCallContext function
* QueryInterface method

To facilitate work of analyst.
It will try to find type by quering debug name of the GUID interface
"""

import idaapi
import idautils
import idc
import sys
import winreg
import struct
import functools
from PyQt5 import QtCore, QtWidgets, QtGui

__author__ = "Airbus CERT"

class ComIDA(idaapi.ida_idaapi.plugin_t):
    """
    This is the main plugin class
    """
    comment = ""
    help = ""
    flags = idaapi.PLUGIN_MOD
    wanted_name = 'ComIDA'
    wanted_hotkey = 'Ctrl-Shift-M'
    hxehook = None

    def init(self):
        """
        Init plugin function
        """
        if idc.get_inf_attr(idc.INF_FILETYPE) != idc.FT_PE:
            # skip if it's not a PE
            return idaapi.PLUGIN_SKIP
        ComIDA.log("'%s' loaded. %s activates/deactivates synchronization." % (ComIDA.wanted_name, ComIDA.wanted_hotkey))
        return idaapi.PLUGIN_KEEP

    def run(self, arg):
        """
        Launch when you press Ctrl-Shift-M
        """
        if idaapi.init_hexrays_plugin():
            if not ComIDA.hxehook:
                ComResultsForm(find_com_references()).show()
                ComIDA.hxehook = ComIdaHook()
                ComIDA.hxehook.hook()
            else:
                ComIDA.hxehook.unhook()
                ComIDA.hxehook = None

        ComIDA.log("%s is %sabled now." % (ComIDA.wanted_name, "en" if ComIDA.hxehook else "dis"))

    def term(self):
        ComIDA.log("%s unloaded." % (ComIDA.wanted_name))
        if idaapi.init_hexrays_plugin() and ComIDA.hxehook:
            ComIDA.hxehook.unhook()
            ComIDA.hxehook = None
            
    def log(message):
         idaapi.msg("[%s] %s\n" % (ComIDA.wanted_name, message))

def check_binary_is_pe():
    """
    Check if we are currently working on a valid PE module
    """
    return idc.get_inf_attr(idc.INF_FILETYPE) == idc.FT_PE


def guid_bytes_to_string(stream):
    """
    Read a byte stream to parse as GUID
    :ivar bytes stream: GUID in raw mode
    :returns: GUID as a string
    :rtype: str
    """
    Data1 = struct.unpack("<I", stream[0:4])[0]
    Data2 = struct.unpack("<H", stream[4:6])[0]
    Data3 = struct.unpack("<H", stream[6:8])[0]
    Data4 = stream[8:16]

    return "%08x-%04x-%04x-%s-%s" % (Data1, Data2, Data3, "".join("%02x" % x for x in Data4[0:2]), "".join("%02x" % x for x in Data4[2:]))


class COMModule:
    """
    Class represent a COM module
    It's defined by GUID name a module path
    """
    def __init__(self, ea, guid, name, module, where):
        """
        :ivar int ea: address of data value
        :ivar str guid: global identifier of COM object
        :ivar str name: name of the com object
        :ivar str name: path of a module in charge of it
        :ivar str where: interface or class string
        """
        self.ea = ea
        self.guid = guid
        self.name = name
        self.module = module
        self.where = where

       
def build_com_from_class_definition(ea, guid):
    """
    Build a COM module object from class definition into registry
    :ivar int operand_value: data reference value
    :returns: new COM definition
    :rtype: COMModule
    :raise: WindowsError
    """
    
    key = winreg.OpenKey(winreg.HKEY_CLASSES_ROOT, "CLSID\\{%s}"%guid)
    _, name, _ = winreg.EnumValue(key, 0)
    module = "Not Found"
    try:
        inprocserver32 = winreg.OpenKey(key, "InprocServer32")
        _, module, _ = winreg.EnumValue(inprocserver32, 0)
    except WindowsError:
        pass
        
    return COMModule(ea, guid, name, module, "class")


def build_com_from_interface_definition(ea, guid):
    """
    Build a com module object from Interface class definition into registry
    :ivar int operand_value: data reference value
    :returns: new COM definition
    :rtype: COMModule
    :raise: WindowsError
    """
    
    key = winreg.OpenKey(winreg.HKEY_CLASSES_ROOT, "Interface\\{%s}"%guid)
    _, name, _ = winreg.EnumValue(key, 0)
    return COMModule(ea, guid, name, "N/A", "interface")

    
def find_guid_in_address_space(start_address, end_address):
    """
    This function will try to parse memonique with an operand value as second
    parameter, then will try to validate it with registry
    :ivar int start_address: 
    """
    result = []
    for head in idautils.Heads(start_address, end_address):
        # search for direct value operand
        for operand_value in [idc.get_operand_value(head, 1), idc.get_operand_value(head, 0)]:
            guid_bytes = idc.get_bytes(operand_value, 16)
            if guid_bytes is None:
                continue
            guid = guid_bytes_to_string(guid_bytes)
            try:
                result.append(build_com_from_class_definition(head, guid))
                break
            except WindowsError as e:
                pass
                
            try:
                result.append(build_com_from_interface_definition(head, guid))
                break
            except WindowsError as e:
                pass
            
    return result

  
def find_com_references():
    """
    This function will try to find data references that match GUIDs
    and return a list of COMModule object with function name
    :return: list of tuble (function_name, COMMOdule)
    :rtype: tuple(str, COMModule)
    """
    result = []
    for seg in idautils.Segments():
        for funcea in idautils.Functions(seg, idc.get_segm_end(seg)):
            result += [(idaapi.ida_funcs.get_func_name(funcea), x) for x in find_guid_in_address_space(funcea, idc.find_func_end(funcea))]       
                
    return result


@functools.lru_cache(maxsize=None)
def find_import(module, function_name):
    """
    Find import address of a function by module name and function name
    :ivar str module: module name
    :ivar str function_name: name of the function from the module
    :returns: address of function
    """
    nimps = idaapi.get_import_module_qty()
    for i in range(0, nimps):
        if idaapi.get_import_module_name(i) != module:
            continue
        ea_ref = [None]
        def find_ea(ea, name, ord):
            if name == function_name:
                ea_ref[0] = ea
                return False
            return True
        idaapi.enum_import_names(i, find_ea)
        return ea_ref[0]
    return None


def infer_function_signature(cfunc, expr, index_interface, index_output):
    """
    This function will infer type of variable present at index_output
    in function signature by type found in registry in accordance 
    to the GUID set at the index_interface
    :ivar cfunc_t cfunc: function object that is decompiling
    :ivar cexpr_t expr: IDA expression AST
    :ivar int index_interface: index of the GUID parameter into function signature
    :ivar int index_output: index of the output variable that will be infer
    """
    
    curent_expr = expr.a[index_output]
    while curent_expr.op in [idaapi.cot_cast, idaapi.cot_ref]:
        curent_expr = curent_expr.x
        
    variable = curent_expr.v

    if variable is None:
        ComIDA.log("Variable name not found")
        return False 
    
    ComIDA.log("infer type of variable: (%s)"%cfunc.lvars[variable.idx].name)
    # try to find type name from third parameter
    value = idc.get_operand_value(expr.a[index_interface].ea, 1)
    if value == -1:
        value = idc.get_operand_value(expr.a[index_interface].ea, 0) # 32 bits case
    guid_bytes = idc.get_bytes(value, 16)
    guid = guid_bytes_to_string(guid_bytes)
    
    interface = None
    try:
        interface = build_com_from_interface_definition(expr.a[index_interface].ea, guid)
    except WindowsError as e:
        ComIDA.log("Interface type (%s) not found"%guid)   
        
    tinfo = idaapi.tinfo_t()
    if interface is None or not tinfo.get_named_type(idaapi.get_idati(), interface.name):
        ComIDA.log("type (%s) not found in registry switch to symbol name base heuristic"%guid)
        symbol_name = idc.get_name(idc.get_operand_value(expr.a[index_interface].ea, 1))
        if symbol_name is None or not tinfo.get_named_type(idaapi.get_idati(), symbol_name[4:]):
            ComIDA.log("unable to find type for (%s)"%guid)
            return False
        
    cfunc.get_lvars()[variable.idx].set_final_lvar_type(idaapi.make_pointer(tinfo))
    return True


class CoFunctionTypeInference(idaapi.ctree_visitor_t):
    """
    This is the visitor class use to visit all note of Hex Rays AST
    This visitor is designed to find call of functions that handle output from interface guid
    
    Before:
        LPVOID v19[2];
        int v1;
        CoCreateInstance(&CLSID_WbemBackupRestore, 0i64, v1, &IID_IWbemBackupRestoreEx, v2);
        
        (*(void (__fastcall **)(LPVOID))(*(_QWORD *)v2[0] + 40i64))(v2[0]);
    
    After:
        IWbemBackupRestoreEx *v19;
        int v1;
        CoCreateInstance(&CLSID_WbemBackupRestore, 0i64, v1, &IID_IWbemBackupRestoreEx, (LPVOID *)&v2);
        
        ((void (__fastcall *)(IWbemBackupRestoreEx *))v2->lpVtbl->Pause)(v2);
    """
    def __init__(self, cfunc, ea_function, index_interface, index_output):
        """
        :ivar cfunc_t cfunc: code function provided by IDA
        :ivar int ea_function: address of the function
        :ivar int index_interface: index of the argument that specify COM interface GUID
        :ivar int index_output: index of the function argument that will be infered in accordance to the GUID
        """
        idaapi.ctree_visitor_t.__init__(self, idaapi.CV_FAST)
        self.cfunc = cfunc
        self.ea_function = ea_function
        self.need_update = False
        self.index_interface = index_interface
        self.index_output = index_output

    def visit_expr(self, i):
        if i.op != idaapi.cot_call:
            return 0
        
        if i.x.obj_ea != self.ea_function:
            return 0

        self.need_update = infer_function_signature(self.cfunc, i, self.index_interface, self.index_output)
        return 0
            
    
    def is_updated(self):
        return self.need_update


class CoMethodTypeInference(idaapi.ctree_visitor_t):
    """
    This visitor is designed to find QueryInterface method calling
    It will find AST pattern ppv->Vtble->QueryInterface
    This must be check after all other inferering method
    """
    def __init__(self, cfunc, method_name, index_interface, index_output):
        """
        :ivar cfunc_t cfunc: code function provided by IDA
        :ivar int ea_function: address of the function
        :ivar int index_interface: index of the argument that specify COM interface GUID
        :ivar int index_output: index of the function argument that will be infered in accordance to the GUID
        """
        idaapi.ctree_visitor_t.__init__(self, idaapi.CV_FAST)
        self.cfunc = cfunc
        self.method_name = method_name
        self.need_update = False
        self.index_interface = index_interface
        self.index_output = index_output

    def visit_expr(self, i):
        if i.op != idaapi.cot_call:
            return 0

        node = i.x
        if node.op == idaapi.cot_cast:
            node = node.x
        
        if node.op != idaapi.cot_memptr:
            return 0
        
        offset = node.m
        node = node.x
        
        type = node.type.get_pointed_object()
        if type is None:
            return 0

        member = idaapi.udt_member_t()
        member.offset = offset * 8
        
        type.find_udt_member(member, idaapi.STRMEM_OFFSET)
        
        if member.name != self.method_name:
            return 0

        self.need_update = infer_function_signature(self.cfunc, i, self.index_interface, self.index_output)
        return 0 
    
    def is_updated(self):
        return self.need_update


def infers_cocreateinstance_variable(cfunc):
    """
    Try infering last variable of CoCreateInstance function
    by checking the GUID of interface and try to find type with same name
    
    :ivar cfunc_t cfunc: Hex-Ray code function
    """
    # Find address of CoCreateInstance
    # Due to ApiScheme redirect need to check both
    ea_cocreateinstance = find_import("ole32", "CoCreateInstance") or find_import("api-ms-win-core-com-l1-1-0", "CoCreateInstance")
    
    if ea_cocreateinstance is None:
        ComIDA.log("There is no references to CoCreateInstance")
        return
        
    v = CoFunctionTypeInference(cfunc, ea_cocreateinstance, 3, 4)
    
    v.apply_to(cfunc.body, None)
    if v.is_updated():
        cfunc.build_c_tree()
        

def infers_cogetcallccontext_variable(cfunc):
    """
    Try infering last variable of CoGetCallContext function
    by checking the GUID of interface and try to find type with same name
    
    :ivar cfunc_t cfunc: Hex-Ray code function
    """
    # Find address of CoGetCallContext
    # Due to ApiScheme redirect need to check both
    ea_cogetcallcontext = find_import("ole32", "CoGetCallContext") or find_import("api-ms-win-core-com-l1-1-0", "CoGetCallContext")
    
    if ea_cogetcallcontext is None:
        ComIDA.log("There is no references to CoGetCallContext")
        return
        
    v = CoFunctionTypeInference(cfunc, ea_cogetcallcontext, 0, 1)
    
    v.apply_to(cfunc.body, None)
    if v.is_updated():
        cfunc.build_c_tree()


def infers_queryinterface_variable(cfunc):
    """
    It will try to infer var by checking QueryInterface call method
    :ivar cfunc_t cfunc: Code function generate by Hex-Rays plugin
    """ 
    v = CoMethodTypeInference(cfunc, "QueryInterface", 1, 2)
    
    v.apply_to(cfunc.body, None)
    if v.is_updated():
        cfunc.build_c_tree()

def infers_com(cfunc):
    """
    Found refreneces to CoCreateInstance function and infere type of last variable
    in accordance of GUID of third parameter
    :ivar cfunc_t cfunc: Code function generate by Hex-Rays plugin
    """
    infers_cocreateinstance_variable(cfunc)
    infers_cogetcallccontext_variable(cfunc)
    # must be at the to use other infering method
    infers_queryinterface_variable(cfunc)
    
       
class ComIdaHook(idaapi.Hexrays_Hooks):
    """
    Install Hex Rays hooks on decompilation
    """
    def __init__(self):
        super().__init__()
        self.prevent_rec = False
    def maturity(self, cfunc, new_maturity):
        """
        This callback is used by decompilator at every step of processing
        """
        if self.prevent_rec:
            return 0
        self.prevent_rec = True
        # We work at the final maturity
        if new_maturity == idaapi.CMAT_FINAL:
            infers_com(cfunc)
        self.prevent_rec = False
        return 0


class ComResultsModel(QtCore.QAbstractTableModel):
    """
    This class is QT class that help to view data from COM parsing
    """
    COL_NAME = 0x00
    COL_FUNCTION = 0x01
    COL_ADDRESS = 0x02
    COL_GUID = 0x03
    COL_COM_TYPE = 0x04
    COL_MODULE = 0x05
    
    def __init__(self, com_module, parent=None):
        super().__init__(parent)

        self._column_headers = {
            ComResultsModel.COL_NAME : 'Name',
            ComResultsModel.COL_ADDRESS : 'Address',
            ComResultsModel.COL_FUNCTION : 'Function',
            ComResultsModel.COL_GUID : 'GUID',
            ComResultsModel.COL_COM_TYPE : 'Object type',
            ComResultsModel.COL_MODULE : 'Module'
        }
        
        self._results = list(com_module)
        self._row_count = len(self._results)

    def flags(self, index):
        return QtCore.Qt.ItemIsEnabled | QtCore.Qt.ItemIsSelectable

    def rowCount(self, index=QtCore.QModelIndex()):
        return self._row_count

    def columnCount(self, index=QtCore.QModelIndex()):
        return len(self._column_headers)

    def headerData(self, column, orientation, role=QtCore.Qt.DisplayRole):
        """
        Define the properties of the the table rows & columns.
        """
        if orientation == QtCore.Qt.Horizontal:

            # the title of the header columns has been requested
            if role == QtCore.Qt.DisplayRole:
                try:
                    return self._column_headers[column]
                except KeyError as e:
                    pass

            # the text alignment of the header has beeen requested
            elif role == QtCore.Qt.TextAlignmentRole:

                # center align all columns
                return QtCore.Qt.AlignHCenter

        # unhandled header request
        return None

    def data(self, index, role=QtCore.Qt.DisplayRole):
        """
        Define how Qt should access the underlying model data.
        """
        # data display request
        if role == QtCore.Qt.DisplayRole:

            # grab for speed
            row = index.row()
            column = index.column()

            if column == ComResultsModel.COL_ADDRESS:
                return "0x%x" % self._results[row][1].ea
            elif column == ComResultsModel.COL_FUNCTION:
                return self._results[row][0]
            elif column == ComResultsModel.COL_NAME:
                return self._results[row][1].name
            elif column == ComResultsModel.COL_GUID:
                return self._results[row][1].guid
            elif column == ComResultsModel.COL_COM_TYPE:
                return self._results[row][1].where
            elif column == ComResultsModel.COL_MODULE:
                return self._results[row][1].module

        # font color request
        elif role == QtCore.Qt.ForegroundRole:
            return QtGui.QColor(QtCore.Qt.black)

        # unhandeled request, nothing to do
        return None
        

class ComResultsForm(idaapi.PluginForm):
    """
    Form that display a table of all COM object found in binary
    """
    def __init__(self, com_modules):

        super().__init__()
        self.com_modules = com_modules
    
    def OnCreate(self, form):
        """
        Initialize the custom PyQt5 content on form creation.
        """

        # Get parent widget
        self._widget  = self.FormToPyQtWidget(form)

        self._init_ui()

    def show(self):
        """
        Make the created form visible as a tabbed view.
        """
        flags = idaapi.PluginForm.WOPN_TAB | idaapi.PluginForm.WOPN_PERSIST 
        return idaapi.PluginForm.Show(self, "COM", flags)

    
    def _init_ui(self):
        """
        Init ui of COM table
        """
        self._model = ComResultsModel(self.com_modules, self._widget)
        self._table = QtWidgets.QTableView()

        # set these properties so the user can arbitrarily shrink the table
        self._table.setMinimumHeight(0)
        self._table.setSizePolicy(
            QtWidgets.QSizePolicy.Ignored,
            QtWidgets.QSizePolicy.Ignored
        )

        self._table.setModel(self._model)

        # jump to disassembly on table row double click
        self._table.doubleClicked.connect(self._ui_entry_double_click)

        # set the initial column widths for the table
        #self._guess_column_width()

        # table selection should be by row, not by cell
        self._table.setSelectionBehavior(QtWidgets.QAbstractItemView.SelectRows)

        # more code-friendly, readable aliases
        vh = self._table.verticalHeader()
        hh = self._table.horizontalHeader()
        vh.setSectionResizeMode(QtWidgets.QHeaderView.Fixed)

        # hide the vertical header themselves as we don't need them
        vh.hide()

        # Allow multiline cells
        self._table.setWordWrap(True) 
        self._table.setTextElideMode(QtCore.Qt.ElideMiddle);
        self._table.resizeColumnsToContents()
        self._table.resizeRowsToContents()

        layout = QtWidgets.QGridLayout()
        layout.addWidget(self._table)
        self._widget.setLayout(layout)

    def _ui_entry_double_click(self, index):
        """
        If user double click it jump to the COM ea
        :ivar int index: index of table
        """
        idaapi.jumpto(self._model._results[index.row()][1].ea)

            
def PLUGIN_ENTRY(): 
    return ComIDA()


repository: JPCERTCC/aa-tools
file: Deob_NOOPLDR.py
description: Artifact analysis tools by JPCERT/CC Analysis Center
url: https://github.com/JPCERTCC/aa-tools/blob/9f6713e6f28595fc67bc229bc23b0cbfb502f538/Deob_NOOPLDR.py
wanted_name: DeobNoopLDR
comment: Deobfuscate win32api on CFF
created_at: 2015-10-28 03:52:32+00:00
pushed_at: 2024-07-09 03:56:17+00:00
content:
#---------------------------------------------------------------------------------
# 20240522 JPCERT/CC masubuchi
# IDA Version 8.4
#---------------------------------------------------------------------------------
try:
    import ida_search
    import ida_bytes
    import idaapi
    import idautils
    import ida_funcs
    import idc
except ImportError:
    pass
#---------------------------------------------------------------------------------

#---------------------------------------------------------------------------------
class ConfigVar:
    DEBUG_MODE = False
    PRE_CHECK_PATCH_LIST = False
    XREF_Threshold = 20
    ADAPT_ALL_FUNCTION = True
#---------------------------------------------------------------------------------

#---------------------------------------------------------------------------------
def dbg_priHex(byte):
    print('[*] Debug: 0x{:02X}'.format(byte))


def findBin_on_range_from_addr(Addr, SearchBytes, Range = -1):
    target_addr = Addr

    if Range < 0:
        for x in range(Range * -1):
            target_addr = idc.prev_head(target_addr)

        hit_addr = ida_search.find_binary(target_addr, Addr, SearchBytes, 0, idaapi.SEARCH_DOWN | idaapi.SEARCH_CASE)
        if hit_addr != idc.BADADDR: 
            return hit_addr

    elif Range > 0:
        for x in range(Range):
            target_addr = idc.next_head(target_addr)

        hit_addr = ida_search.find_binary(Addr, target_addr, SearchBytes, 0, idaapi.SEARCH_DOWN | idaapi.SEARCH_CASE)
        if hit_addr != idc.BADADDR: 
            return hit_addr

    return False


def get_NumOfXrefAddr_from_Addr(ea):
    count = 0
    for addr in idautils.CodeRefsTo(ea, 0):
        count += 1
    return count


def get_NumOfXref_on_callAddr(ea):
    call_jumpAddr = idc.get_operand_value(ea, 0)
    return get_NumOfXrefAddr_from_Addr(call_jumpAddr)


def read_bytesdata(addr, size):
    bytesdata = idaapi.get_bytes(addr, size)
    if bytesdata != idc.BADADDR:
        return bytesdata
    return False


def get_SizeOfInst(ea):
    next_addr = idc.next_head(ea)
    if next_addr != idc.BADADDR: 
        SizeOfInst = next_addr - ea
        return SizeOfInst
    return 0


def binarypatching(addr, patchbytes, patchInst_string):
    before_inst = idc.generate_disasm_line(addr, 0)
    patchSize = get_SizeOfInst(addr)
    before_bytes = read_bytesdata(addr, patchSize)

    print('[+] 0x{:02X}\n    << {}\t{}\n    >> {}\t{}'
        .format(addr, before_bytes, before_inst, patchbytes, patchInst_string))
    ida_bytes.patch_bytes(addr, patchbytes)


def isFunctionNameWin32API(FunctionName):
    for api in GV_LIST.LIST_WIN32API:
        if api in FunctionName:
            return True
    return False


def GetPatchingTargetList(ea, xrefThreshold):
    TargetList = []

    f = ida_funcs.get_func(ea)
    for ea in idautils.Heads(f.start_ea, f.end_ea):
        opcode = idc.print_insn_mnem(ea)
        if opcode == "call":
            functionName = idc.print_operand(ea,0)
            if isFunctionNameWin32API(functionName):
                if ConfigVar.DEBUG_MODE:
                    dbg_priHex(ea)
                    print(functionName)
                    print(get_NumOfXref_on_callAddr(ea) )
                if get_NumOfXref_on_callAddr(ea) >= xrefThreshold :
                    hitAddr01 = findBin_on_range_from_addr(ea, "31 C9", Range = -5)     # 31 C9     xor ecx, ecx
                    hitAddr02 = findBin_on_range_from_addr(ea, "31 D2", Range = -5)     # 31 D2     xor edx, edx
                    hitAddr03 = findBin_on_range_from_addr(ea, "31 F6", Range = -5)     # 31 F6     xor esi, esi
                    hitAddr04 = findBin_on_range_from_addr(ea, "45 31 C0", Range = -5)  # 45 31 C0  xor r8d, r8d
                    hitAddr05 = findBin_on_range_from_addr(ea, "45 31 C9", Range = -5)  # 45 31 C9  xor r9d, r9d
                    if [hitAddr01, hitAddr02, hitAddr03, hitAddr04, hitAddr05].count(False) <= 3:
                        TargetList.append(ea)
                    elif ("PathIsNetworkPathW" in functionName) and hitAddr01 != False:
                        TargetList.append(ea)
                    elif ("PathMakePrettyW" in functionName) and hitAddr01 != False:
                        TargetList.append(ea)
                    elif ("EncodeSystemPointer" in functionName) and hitAddr01 != False:
                        TargetList.append(ea)
                    else:
                        continue
            else:
                # Indirect call instruction
                for ref in idautils.XrefsFrom(ea):
                    if ref.type == 17:
                        xrefsfrom_funcname = idc.get_name(ref.to)
                        if isFunctionNameWin32API(xrefsfrom_funcname):
                            hitAddr01 = findBin_on_range_from_addr(ea, "31 C9", Range = -5)     # 31 C9     xor ecx, ecx
                            hitAddr02 = findBin_on_range_from_addr(ea, "31 D2", Range = -5)     # 31 D2     xor edx, edx
                            hitAddr03 = findBin_on_range_from_addr(ea, "31 F6", Range = -5)     # 31 F6     xor esi, esi
                            hitAddr04 = findBin_on_range_from_addr(ea, "45 31 C0", Range = -5)  # 45 31 C0  xor r8d, r8d
                            hitAddr05 = findBin_on_range_from_addr(ea, "45 31 C9", Range = -5)  # 45 31 C9  xor r9d, r9d
                            if [hitAddr01, hitAddr02, hitAddr03, hitAddr04, hitAddr05].count(False) <= 3:
                                TargetList.append(ea)
                            elif ("PathIsNetworkPathW" in xrefsfrom_funcname) and hitAddr01 != False:
                                TargetList.append(ea)
                            elif ("PathMakePrettyW" in xrefsfrom_funcname) and hitAddr01 != False:
                                TargetList.append(ea)
                            elif ("EncodeSystemPointer" in xrefsfrom_funcname) and hitAddr01 != False:
                                TargetList.append(ea)
                            else:
                                continue
    return TargetList


def patch_to_ret0(addr):
    nop_count = get_SizeOfInst(addr) - 2
    patchbytes = b"\x31\xc0" + nop_count * b"\x90"

    if ConfigVar.PRE_CHECK_PATCH_LIST:
        dbg_priHex(addr)
        print(idc.print_operand(addr,0))
    else:
        binarypatching(addr, patchbytes, "xor eax,eax + [NOP-Padding]")

def deobCurrentFunc(ea):
    TargetList = GetPatchingTargetList(ea, ConfigVar.XREF_Threshold)
    for addr in TargetList:
        patch_to_ret0(addr)


def deobCurrentFunc_EA():
    ea = idc.get_screen_ea()
    deobCurrentFunc(ea)


def deobCurrentFunc_ALL():
    for ea in idautils.Segments():
        for s in idautils.Functions(idc.get_segm_start(ea), idc.get_segm_end(ea)):
            f = ida_funcs.get_func(s)
            funcEA = f.start_ea
            deobCurrentFunc(funcEA)


def main():
    print("[*] -- START! --")
    
    if ConfigVar.ADAPT_ALL_FUNCTION:
        print("all func")
        deobCurrentFunc_ALL()
    else:
        deobCurrentFunc_EA()
    
    print("[*] -- Finish! --")


#---------------------------------------------------------------------------------
#if __name__ == '__main__':
#    main()
#---------------------------------------------------------------------------------


class DeobNoopLDR_Plugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_DRAW
    comment = "Deobfuscate win32api on CFF"
    help = ""
    wanted_name = "DeobNoopLDR"
    wanted_hotkey = "" # = "Alt-F10"

    def init(self):
        return idaapi.PLUGIN_KEEP

    def run(self, arg):
        main()
        return

    def term(self):
        pass


def PLUGIN_ENTRY():
    return DeobNoopLDR_Plugin()



class GV_LIST:
    LIST_WIN32API = ['AcquireSRWLockExclusive', 'AcquireSRWLockShared', 'ActivateActCtx', 'ActivateActCtxWorker', 'AddAtomA', 'AddAtomW', 'AddConsoleAliasA', 'AddConsoleAliasW', 'AddDllDirectory', 'AddIntegrityLabelToBoundaryDescriptor', 'AddLocalAlternateComputerNameA', 'AddLocalAlternateComputerNameW', 'AddRefActCtx', 'AddRefActCtxWorker', 'AddResourceAttributeAce', 'AddSIDToBoundaryDescriptor', 'AddScopedPolicyIDAce', 'AddSecureMemoryCacheCallback', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'AdjustCalendarDate', 'AllocConsole', 'AllocateUserPhysicalPages', 'AllocateUserPhysicalPagesNuma', 'AppPolicyGetClrCompat', 'AppPolicyGetCreateFileAccess', 'AppPolicyGetLifecycleManagement', 'AppPolicyGetMediaFoundationCodecLoading', 'AppPolicyGetProcessTerminationMethod', 'AppPolicyGetShowDeveloperDiagnostic', 'AppPolicyGetThreadInitializationType', 'AppPolicyGetWindowingModel', 'AppXGetOSMaxVersionTested', 'ApplicationRecoveryFinished', 'ApplicationRecoveryInProgress', 'AreFileApisANSI', 'AssignProcessToJobObject', 'AttachConsole', 'BackupRead', 'BackupSeek', 'BackupWrite', 'BaseCheckAppcompatCache', 'BaseCheckAppcompatCacheEx', 'BaseCheckAppcompatCacheExWorker', 'BaseCheckAppcompatCacheWorker', 'BaseCheckElevation', 'BaseCleanupAppcompatCacheSupport', 'BaseCleanupAppcompatCacheSupportWorker', 'BaseDestroyVDMEnvironment', 'BaseDllReadWriteIniFile', 'BaseDumpAppcompatCache', 'BaseDumpAppcompatCacheWorker', 'BaseElevationPostProcessing', 'BaseFlushAppcompatCache', 'BaseFlushAppcompatCacheWorker', 'BaseFormatObjectAttributes', 'BaseFormatTimeOut', 'BaseFreeAppCompatDataForProcessWorker', 'BaseGenerateAppCompatData', 'BaseGetNamedObjectDirectory', 'BaseInitAppcompatCacheSupport', 'BaseInitAppcompatCacheSupportWorker', 'BaseIsAppcompatInfrastructureDisabled', 'BaseIsAppcompatInfrastructureDisabledWorker', 'BaseIsDosApplication', 'BaseQueryModuleData', 'BaseReadAppCompatDataForProcessWorker', 'BaseSetLastNTError', 'BaseThreadInitThunk', 'BaseUpdateAppcompatCache', 'BaseUpdateAppcompatCacheWorker', 'BaseUpdateVDMEntry', 'BaseVerifyUnicodeString', 'BaseWriteErrorElevationRequiredEvent', 'Basep8BitStringToDynamicUnicodeString', 'BasepAllocateActivationContextActivationBlock', 'BasepAnsiStringToDynamicUnicodeString', 'BasepAppContainerEnvironmentExtension', 'BasepAppXExtension', 'BasepCheckAppCompat', 'BasepCheckWebBladeHashes', 'BasepCheckWinSaferRestrictions', 'BasepConstructSxsCreateProcessMessage', 'BasepCopyEncryption', 'BasepFreeActivationContextActivationBlock', 'BasepFreeAppCompatData', 'BasepGetAppCompatData', 'BasepGetComputerNameFromNtPath', 'BasepGetExeArchType', 'BasepInitAppCompatData', 'BasepIsProcessAllowed', 'BasepMapModuleHandle', 'BasepNotifyLoadStringResource', 'BasepPostSuccessAppXExtension', 'BasepProcessInvalidImage', 'BasepQueryAppCompat', 'BasepQueryModuleChpeSettings', 'BasepReleaseAppXContext', 'BasepReleaseSxsCreateProcessUtilityStruct', 'BasepReportFault', 'BasepSetFileEncryptionCompression', 'Beep', 'BeginUpdateResourceA', 'BeginUpdateResourceW', 'BindIoCompletionCallback', 'BuildCommDCBA', 'BuildCommDCBAndTimeoutsA', 'BuildCommDCBAndTimeoutsW', 'BuildCommDCBW', 'CallNamedPipeA', 'CallNamedPipeW', 'CallbackMayRunLong', 'CancelDeviceWakeupRequest', 'CancelIo', 'CancelIoEx', 'CancelSynchronousIo', 'CancelThreadpoolIo', 'CancelTimerQueueTimer', 'CancelWaitableTimer', 'CeipIsOptedIn', 'ChangeTimerQueueTimer', 'CheckAllowDecryptedRemoteDestinationPolicy', 'CheckElevation', 'CheckElevationEnabled', 'CheckForReadOnlyResource', 'CheckForReadOnlyResourceFilter', 'CheckNameLegalDOS8Dot3A', 'CheckNameLegalDOS8Dot3W', 'CheckRemoteDebuggerPresent', 'CheckTokenCapability', 'CheckTokenMembershipEx', 'ClearCommBreak', 'ClearCommError', 'CloseConsoleHandle', 'CloseHandle', 'ClosePackageInfo', 'ClosePrivateNamespace', 'CloseProfileUserMapping', 'ClosePseudoConsole', 'CloseState', 'CloseThreadpool', 'CloseThreadpoolCleanupGroup', 'CloseThreadpoolCleanupGroupMembers', 'CloseThreadpoolIo', 'CloseThreadpoolTimer', 'CloseThreadpoolWait', 'CloseThreadpoolWork', 'CmdBatNotification', 'CommConfigDialogA', 'CommConfigDialogW', 'CompareCalendarDates', 'CompareFileTime', 'CompareStringA', 'CompareStringEx', 'CompareStringOrdinal', 'CompareStringW', 'ConnectNamedPipe', 'ConsoleMenuControl', 'ContinueDebugEvent', 'ConvertCalDateTimeToSystemTime', 'ConvertDefaultLocale', 'ConvertFiberToThread', 'ConvertNLSDayOfWeekToWin32DayOfWeek', 'ConvertSystemTimeToCalDateTime', 'ConvertThreadToFiber', 'ConvertThreadToFiberEx', 'CopyContext', 'CopyFile2', 'CopyFileA', 'CopyFileExA', 'CopyFileExW', 'CopyFileTransactedA', 'CopyFileTransactedW', 'CopyFileW', 'CopyLZFile', 'CreateActCtxA', 'CreateActCtxW', 'CreateActCtxWWorker', 'CreateBoundaryDescriptorA', 'CreateBoundaryDescriptorW', 'CreateConsoleScreenBuffer', 'CreateDirectoryA', 'CreateDirectoryExA', 'CreateDirectoryExW', 'CreateDirectoryTransactedA', 'CreateDirectoryTransactedW', 'CreateDirectoryW', 'CreateEnclave', 'CreateEventA', 'CreateEventExA', 'CreateEventExW', 'CreateEventW', 'CreateFiber', 'CreateFiberEx', 'CreateFile2', 'CreateFileA', 'CreateFileMappingA', 'CreateFileMappingFromApp', 'CreateFileMappingNumaA', 'CreateFileMappingNumaW', 'CreateFileMappingW', 'CreateFileTransactedA', 'CreateFileTransactedW', 'CreateFileW', 'CreateHardLinkA', 'CreateHardLinkTransactedA', 'CreateHardLinkTransactedW', 'CreateHardLinkW', 'CreateIoCompletionPort', 'CreateJobObjectA', 'CreateJobObjectW', 'CreateJobSet', 'CreateMailslotA', 'CreateMailslotW', 'CreateMemoryResourceNotification', 'CreateMutexA', 'CreateMutexExA', 'CreateMutexExW', 'CreateMutexW', 'CreateNamedPipeA', 'CreateNamedPipeW', 'CreatePipe', 'CreatePrivateNamespaceA', 'CreatePrivateNamespaceW', 'CreateProcessA', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'CreateProcessInternalA', 'CreateProcessInternalW', 'CreateProcessW', 'CreatePseudoConsole', 'CreateRemoteThread', 'CreateRemoteThreadEx', 'CreateSemaphoreA', 'CreateSemaphoreExA', 'CreateSemaphoreExW', 'CreateSemaphoreW', 'CreateSymbolicLinkA', 'CreateSymbolicLinkTransactedA', 'CreateSymbolicLinkTransactedW', 'CreateSymbolicLinkW', 'CreateTapePartition', 'CreateThread', 'CreateThreadpool', 'CreateThreadpoolCleanupGroup', 'CreateThreadpoolIo', 'CreateThreadpoolTimer', 'CreateThreadpoolWait', 'CreateThreadpoolWork', 'CreateTimerQueue', 'CreateTimerQueueTimer', 'CreateToolhelp32Snapshot', 'CreateUmsCompletionList', 'CreateUmsThreadContext', 'CreateWaitableTimerA', 'CreateWaitableTimerExA', 'CreateWaitableTimerExW', 'CreateWaitableTimerW', 'CtrlRoutine', 'DeactivateActCtx', 'DeactivateActCtxWorker', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugBreak', 'DebugBreakProcess', 'DebugSetProcessKillOnExit', 'DecodePointer', 'DecodeSystemPointer', 'DefineDosDeviceA', 'DefineDosDeviceW', 'DelayLoadFailureHook', 'DeleteAtom', 'DeleteBoundaryDescriptor', 'DeleteCriticalSection', 'DeleteFiber', 'DeleteFileA', 'DeleteFileTransactedA', 'DeleteFileTransactedW', 'DeleteFileW', 'DeleteProcThreadAttributeList', 'DeleteSynchronizationBarrier', 'DeleteTimerQueue', 'DeleteTimerQueueEx', 'DeleteTimerQueueTimer', 'DeleteUmsCompletionList', 'DeleteUmsThreadContext', 'DeleteVolumeMountPointA', 'DeleteVolumeMountPointW', 'DequeueUmsCompletionListItems', 'DeviceIoControl', 'DisableThreadLibraryCalls', 'DisableThreadProfiling', 'DisassociateCurrentThreadFromCallback', 'DiscardVirtualMemory', 'DisconnectNamedPipe', 'DnsHostnameToComputerNameA', 'DnsHostnameToComputerNameExW', 'DnsHostnameToComputerNameW', 'DosDateTimeToFileTime', 'DosPathToSessionPathA', 'DosPathToSessionPathW', 'DuplicateConsoleHandle', 'DuplicateEncryptionInfoFileExt', 'DuplicateHandle', 'EnableThreadProfiling', 'EncodePointer', 'EncodeSystemPointer', 'EndUpdateResourceA', 'EndUpdateResourceW', 'EnterCriticalSection', 'EnterSynchronizationBarrier', 'EnterUmsSchedulingMode', 'EnumCalendarInfoA', 'EnumCalendarInfoExA', 'EnumCalendarInfoExEx', 'EnumCalendarInfoExW', 'EnumCalendarInfoW', 'EnumDateFormatsA', 'EnumDateFormatsExA', 'EnumDateFormatsExEx', 'EnumDateFormatsExW', 'EnumDateFormatsW', 'EnumLanguageGroupLocalesA', 'EnumLanguageGroupLocalesW', 'EnumResourceLanguagesA', 'EnumResourceLanguagesExA', 'EnumResourceLanguagesExW', 'EnumResourceLanguagesW', 'EnumResourceNamesA', 'EnumResourceNamesExA', 'EnumResourceNamesExW', 'EnumResourceNamesW', 'EnumResourceTypesA', 'EnumResourceTypesExA', 'EnumResourceTypesExW', 'EnumResourceTypesW', 'EnumSystemCodePagesA', 'EnumSystemCodePagesW', 'EnumSystemFirmwareTables', 'EnumSystemGeoID', 'EnumSystemGeoNames', 'EnumSystemLanguageGroupsA', 'EnumSystemLanguageGroupsW', 'EnumSystemLocalesA', 'EnumSystemLocalesEx', 'EnumSystemLocalesW', 'EnumTimeFormatsA', 'EnumTimeFormatsEx', 'EnumTimeFormatsW', 'EnumUILanguagesA', 'EnumUILanguagesW', 'EnumerateLocalComputerNamesA', 'EnumerateLocalComputerNamesW', 'EraseTape', 'EscapeCommFunction', 'ExecuteUmsThread', 'ExitProcess', 'ExitThread', 'ExitVDM', 'ExpandEnvironmentStringsA', 'ExpandEnvironmentStringsW', 'ExpungeConsoleCommandHistoryA', 'ExpungeConsoleCommandHistoryW', 'FatalAppExitA', 'FatalAppExitW', 'FatalExit', 'FileTimeToDosDateTime', 'FileTimeToLocalFileTime', 'FileTimeToSystemTime', 'FillConsoleOutputAttribute', 'FillConsoleOutputCharacterA', 'FillConsoleOutputCharacterW', 'FindActCtxSectionGuid', 'FindActCtxSectionGuidWorker', 'FindActCtxSectionStringA', 'FindActCtxSectionStringW', 'FindActCtxSectionStringWWorker', 'FindAtomA', 'FindAtomW', 'FindClose', 'FindCloseChangeNotification', 'FindFirstChangeNotificationA', 'FindFirstChangeNotificationW', 'FindFirstFileA', 'FindFirstFileExA', 'FindFirstFileExW', 'FindFirstFileNameTransactedW', 'FindFirstFileNameW', 'FindFirstFileTransactedA', 'FindFirstFileTransactedW', 'FindFirstFileW', 'FindFirstStreamTransactedW', 'FindFirstStreamW', 'FindFirstVolumeA', 'FindFirstVolumeMountPointA', 'FindFirstVolumeMountPointW', 'FindFirstVolumeW', 'FindNLSString', 'FindNLSStringEx', 'FindNextChangeNotification', 'FindNextFileA', 'FindNextFileNameW', 'FindNextFileW', 'FindNextStreamW', 'FindNextVolumeA', 'FindNextVolumeMountPointA', 'FindNextVolumeMountPointW', 'FindNextVolumeW', 'FindPackagesByPackageFamily', 'FindResourceA', 'FindResourceExA', 'FindResourceExW', 'FindResourceW', 'FindStringOrdinal', 'FindVolumeClose', 'FindVolumeMountPointClose', 'FlsAlloc', 'FlsFree', 'FlsGetValue', 'FlsSetValue', 'FlushConsoleInputBuffer', 'FlushFileBuffers', 'FlushInstructionCache', 'FlushProcessWriteBuffers', 'FlushViewOfFile', 'FoldStringA', 'FoldStringW', 'FormatApplicationUserModelId', 'FormatMessageA', 'FormatMessageW', 'FreeConsole', 'FreeEnvironmentStringsA', 'FreeEnvironmentStringsW', 'FreeLibrary', 'FreeLibraryAndExitThread', 'FreeLibraryWhenCallbackReturns', 'FreeMemoryJobObject', 'FreeResource', 'FreeUserPhysicalPages', 'GenerateConsoleCtrlEvent', 'GetACP', 'GetActiveProcessorCount', 'GetActiveProcessorGroupCount', 'GetAppContainerAce', 'GetAppContainerNamedObjectPath', 'GetApplicationRecoveryCallback', 'GetApplicationRecoveryCallbackWorker', 'GetApplicationRestartSettings', 'GetApplicationRestartSettingsWorker', 'GetApplicationUserModelId', 'GetAtomNameA', 'GetAtomNameW', 'GetBinaryType', 'GetBinaryTypeA', 'GetBinaryTypeW', 'GetCPInfo', 'GetCPInfoExA', 'GetCPInfoExW', 'GetCachedSigningLevel', 'GetCalendarDateFormat', 'GetCalendarDateFormatEx', 'GetCalendarDaysInMonth', 'GetCalendarDifferenceInDays', 'GetCalendarInfoA', 'GetCalendarInfoEx', 'GetCalendarInfoW', 'GetCalendarMonthsInYear', 'GetCalendarSupportedDateRange', 'GetCalendarWeekNumber', 'GetComPlusPackageInstallStatus', 'GetCommConfig', 'GetCommMask', 'GetCommModemStatus', 'GetCommProperties', 'GetCommState', 'GetCommTimeouts', 'GetCommandLineA', 'GetCommandLineW', 'GetCompressedFileSizeA', 'GetCompressedFileSizeTransactedA', 'GetCompressedFileSizeTransactedW', 'GetCompressedFileSizeW', 'GetComputerNameA', 'GetComputerNameExA', 'GetComputerNameExW', 'GetComputerNameW', 'GetConsoleAliasA', 'GetConsoleAliasExesA', 'GetConsoleAliasExesLengthA', 'GetConsoleAliasExesLengthW', 'GetConsoleAliasExesW', 'GetConsoleAliasW', 'GetConsoleAliasesA', 'GetConsoleAliasesLengthA', 'GetConsoleAliasesLengthW', 'GetConsoleAliasesW', 'GetConsoleCP', 'GetConsoleCharType', 'GetConsoleCommandHistoryA', 'GetConsoleCommandHistoryLengthA', 'GetConsoleCommandHistoryLengthW', 'GetConsoleCommandHistoryW', 'GetConsoleCursorInfo', 'GetConsoleCursorMode', 'GetConsoleDisplayMode', 'GetConsoleFontInfo', 'GetConsoleFontSize', 'GetConsoleHardwareState', 'GetConsoleHistoryInfo', 'GetConsoleInputExeNameA', 'GetConsoleInputExeNameW', 'GetConsoleInputWaitHandle', 'GetConsoleKeyboardLayoutNameA', 'GetConsoleKeyboardLayoutNameW', 'GetConsoleMode', 'GetConsoleNlsMode', 'GetConsoleOriginalTitleA', 'GetConsoleOriginalTitleW', 'GetConsoleOutputCP', 'GetConsoleProcessList', 'GetConsoleScreenBufferInfo', 'GetConsoleScreenBufferInfoEx', 'GetConsoleSelectionInfo', 'GetConsoleTitleA', 'GetConsoleTitleW', 'GetConsoleWindow', 'GetCurrencyFormatA', 'GetCurrencyFormatEx', 'GetCurrencyFormatW', 'GetCurrentActCtx', 'GetCurrentActCtxWorker', 'GetCurrentApplicationUserModelId', 'GetCurrentConsoleFont', 'GetCurrentConsoleFontEx', 'GetCurrentDirectoryA', 'GetCurrentDirectoryW', 'GetCurrentPackageFamilyName', 'GetCurrentPackageFullName', 'GetCurrentPackageId', 'GetCurrentPackageInfo', 'GetCurrentPackagePath', 'GetCurrentProcess', 'GetCurrentProcessId', 'GetCurrentProcessorNumber', 'GetCurrentProcessorNumberEx', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentThreadStackLimits', 'GetCurrentUmsThread', 'GetDateFormatA', 'GetDateFormatAWorker', 'GetDateFormatEx', 'GetDateFormatW', 'GetDateFormatWWorker', 'GetDefaultCommConfigA', 'GetDefaultCommConfigW', 'GetDevicePowerState', 'GetDiskFreeSpaceA', 'GetDiskFreeSpaceExA', 'GetDiskFreeSpaceExW', 'GetDiskFreeSpaceW', 'GetDiskSpaceInformationA', 'GetDiskSpaceInformationW', 'GetDllDirectoryA', 'GetDllDirectoryW', 'GetDriveTypeA', 'GetDriveTypeW', 'GetDurationFormat', 'GetDurationFormatEx', 'GetDynamicTimeZoneInformation', 'GetEnabledXStateFeatures', 'GetEncryptedFileVersionExt', 'GetEnvironmentStrings', 'GetEnvironmentStringsA', 'GetEnvironmentStringsW', 'GetEnvironmentVariableA', 'GetEnvironmentVariableW', 'GetEraNameCountedString', 'GetErrorMode', 'GetExitCodeProcess', 'GetExitCodeThread', 'GetExpandedNameA', 'GetExpandedNameW', 'GetFileAttributesA', 'GetFileAttributesExA', 'GetFileAttributesExW', 'GetFileAttributesTransactedA', 'GetFileAttributesTransactedW', 'GetFileAttributesW', 'GetFileBandwidthReservation', 'GetFileInformationByHandle', 'GetFileInformationByHandleEx', 'GetFileMUIInfo', 'GetFileMUIPath', 'GetFileSize', 'GetFileSizeEx', 'GetFileTime', 'GetFileType', 'GetFinalPathNameByHandleA', 'GetFinalPathNameByHandleW', 'GetFirmwareEnvironmentVariableA', 'GetFirmwareEnvironmentVariableExA', 'GetFirmwareEnvironmentVariableExW', 'GetFirmwareEnvironmentVariableW', 'GetFirmwareType', 'GetFullPathNameA', 'GetFullPathNameTransactedA', 'GetFullPathNameTransactedW', 'GetFullPathNameW', 'GetGeoInfoA', 'GetGeoInfoEx', 'GetGeoInfoW', 'GetHandleInformation', 'GetLargePageMinimum', 'GetLargestConsoleWindowSize', 'GetLastError', 'GetLocalTime', 'GetLocaleInfoA', 'GetLocaleInfoEx', 'GetLocaleInfoW', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetLogicalDrives', 'GetLogicalProcessorInformation', 'GetLogicalProcessorInformationEx', 'GetLongPathNameA', 'GetLongPathNameTransactedA', 'GetLongPathNameTransactedW', 'GetLongPathNameW', 'GetMailslotInfo', 'GetMaximumProcessorCount', 'GetMaximumProcessorGroupCount', 'GetMemoryErrorHandlingCapabilities', 'GetModuleFileNameA', 'GetModuleFileNameW', 'GetModuleHandleA', 'GetModuleHandleExA', 'GetModuleHandleExW', 'GetModuleHandleW', 'GetNLSVersion', 'GetNLSVersionEx', 'GetNamedPipeAttribute', 'GetNamedPipeClientComputerNameA', 'GetNamedPipeClientComputerNameW', 'GetNamedPipeClientProcessId', 'GetNamedPipeClientSessionId', 'GetNamedPipeHandleStateA', 'GetNamedPipeHandleStateW', 'GetNamedPipeInfo', 'GetNamedPipeServerProcessId', 'GetNamedPipeServerSessionId', 'GetNativeSystemInfo', 'GetNextUmsListItem', 'GetNextVDMCommand', 'GetNumaAvailableMemoryNode', 'GetNumaAvailableMemoryNodeEx', 'GetNumaHighestNodeNumber', 'GetNumaNodeNumberFromHandle', 'GetNumaNodeProcessorMask', 'GetNumaNodeProcessorMaskEx', 'GetNumaProcessorNode', 'GetNumaProcessorNodeEx', 'GetNumaProximityNode', 'GetNumaProximityNodeEx', 'GetNumberFormatA', 'GetNumberFormatEx', 'GetNumberFormatW', 'GetNumberOfConsoleFonts', 'GetNumberOfConsoleInputEvents', 'GetNumberOfConsoleMouseButtons', 'GetOEMCP', 'GetOverlappedResult', 'GetOverlappedResultEx', 'GetPackageApplicationIds', 'GetPackageFamilyName', 'GetPackageFullName', 'GetPackageId', 'GetPackageInfo', 'GetPackagePath', 'GetPackagePathByFullName', 'GetPackagesByPackageFamily', 'GetPhysicallyInstalledSystemMemory', 'GetPriorityClass', 'GetPrivateProfileIntA', 'GetPrivateProfileIntW', 'GetPrivateProfileSectionA', 'GetPrivateProfileSectionNamesA', 'GetPrivateProfileSectionNamesW', 'GetPrivateProfileSectionW', 'GetPrivateProfileStringA', 'GetPrivateProfileStringW', 'GetPrivateProfileStructA', 'GetPrivateProfileStructW', 'GetProcAddress', 'GetProcessAffinityMask', 'GetProcessDEPPolicy', 'GetProcessDefaultCpuSets', 'GetProcessGroupAffinity', 'GetProcessHandleCount', 'GetProcessHeap', 'GetProcessHeaps', 'GetProcessId', 'GetProcessIdOfThread', 'GetProcessInformation', 'GetProcessIoCounters', 'GetProcessMitigationPolicy', 'GetProcessPreferredUILanguages', 'GetProcessPriorityBoost', 'GetProcessShutdownParameters', 'GetProcessTimes', 'GetProcessVersion', 'GetProcessWorkingSetSize', 'GetProcessWorkingSetSizeEx', 'GetProcessorSystemCycleTime', 'GetProductInfo', 'GetProfileIntA', 'GetProfileIntW', 'GetProfileSectionA', 'GetProfileSectionW', 'GetProfileStringA', 'GetProfileStringW', 'GetQueuedCompletionStatus', 'GetQueuedCompletionStatusEx', 'GetShortPathNameA', 'GetShortPathNameW', 'GetStagedPackagePathByFullName', 'GetStartupInfoA', 'GetStartupInfoW', 'GetStateFolder', 'GetStdHandle', 'GetStringScripts', 'GetStringTypeA', 'GetStringTypeExA', 'GetStringTypeExW', 'GetStringTypeW', 'GetSystemAppDataKey', 'GetSystemCpuSetInformation', 'GetSystemDEPPolicy', 'GetSystemDefaultLCID', 'GetSystemDefaultLangID', 'GetSystemDefaultLocaleName', 'GetSystemDefaultUILanguage', 'GetSystemDirectoryA', 'GetSystemDirectoryW', 'GetSystemFileCacheSize', 'GetSystemFirmwareTable', 'GetSystemInfo', 'GetSystemPowerStatus', 'GetSystemPreferredUILanguages', 'GetSystemRegistryQuota', 'GetSystemTime', 'GetSystemTimeAdjustment', 'GetSystemTimeAsFileTime', 'GetSystemTimePreciseAsFileTime', 'GetSystemTimes', 'GetSystemWindowsDirectoryA', 'GetSystemWindowsDirectoryW', 'GetSystemWow64DirectoryA', 'GetSystemWow64DirectoryW', 'GetTapeParameters', 'GetTapePosition', 'GetTapeStatus', 'GetTempFileNameA', 'GetTempFileNameW', 'GetTempPathA', 'GetTempPathW', 'GetThreadContext', 'GetThreadDescription', 'GetThreadErrorMode', 'GetThreadGroupAffinity', 'GetThreadIOPendingFlag', 'GetThreadId', 'GetThreadIdealProcessorEx', 'GetThreadInformation', 'GetThreadLocale', 'GetThreadPreferredUILanguages', 'GetThreadPriority', 'GetThreadPriorityBoost', 'GetThreadSelectedCpuSets', 'GetThreadSelectorEntry', 'GetThreadTimes', 'GetThreadUILanguage', 'GetTickCount', 'GetTickCount64', 'GetTimeFormatA', 'GetTimeFormatAWorker', 'GetTimeFormatEx', 'GetTimeFormatW', 'GetTimeFormatWWorker', 'GetTimeZoneInformation', 'GetTimeZoneInformationForYear', 'GetUILanguageInfo', 'GetUmsCompletionListEvent', 'GetUmsSystemThreadInformation', 'GetUserDefaultGeoName', 'GetUserDefaultLCID', 'GetUserDefaultLangID', 'GetUserDefaultLocaleName', 'GetUserDefaultUILanguage', 'GetUserGeoID', 'GetUserPreferredUILanguages', 'GetVDMCurrentDirectories', 'GetVersion', 'GetVersionExA', 'GetVersionExW', 'GetVolumeInformationA', 'GetVolumeInformationByHandleW', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetVolumePathNameA', 'GetVolumePathNameW', 'GetVolumePathNamesForVolumeNameA', 'GetVolumePathNamesForVolumeNameW', 'GetWindowsDirectoryA', 'GetWindowsDirectoryW', 'GetWriteWatch', 'GetXStateFeaturesMask', 'GlobalAddAtomA', 'GlobalAddAtomExA', 'GlobalAddAtomExW', 'GlobalAddAtomW', 'GlobalAlloc', 'GlobalCompact', 'GlobalDeleteAtom', 'GlobalFindAtomA', 'GlobalFindAtomW', 'GlobalFix', 'GlobalFlags', 'GlobalFree', 'GlobalGetAtomNameA', 'GlobalGetAtomNameW', 'GlobalHandle', 'GlobalLock', 'GlobalMemoryStatus', 'GlobalMemoryStatusEx', 'GlobalReAlloc', 'GlobalSize', 'GlobalUnWire', 'GlobalUnfix', 'GlobalUnlock', 'GlobalWire', 'Heap32First', 'Heap32ListFirst', 'Heap32ListNext', 'Heap32Next', 'HeapAlloc', 'HeapCompact', 'HeapCreate', 'HeapDestroy', 'HeapFree', 'HeapLock', 'HeapQueryInformation', 'HeapReAlloc', 'HeapSetInformation', 'HeapSize', 'HeapSummary', 'HeapUnlock', 'HeapValidate', 'HeapWalk', 'IdnToAscii', 'IdnToNameprepUnicode', 'IdnToUnicode', 'InitAtomTable', 'InitOnceBeginInitialize', 'InitOnceComplete', 'InitOnceExecuteOnce', 'InitOnceInitialize', 'InitializeConditionVariable', 'InitializeContext', 'InitializeContext2', 'InitializeCriticalSection', 'InitializeCriticalSectionAndSpinCount', 'InitializeCriticalSectionEx', 'InitializeEnclave', 'InitializeProcThreadAttributeList', 'InitializeSListHead', 'InitializeSRWLock', 'InitializeSynchronizationBarrier', 'InstallELAMCertificateInfo', 'InterlockedFlushSList', 'InterlockedPopEntrySList', 'InterlockedPushEntrySList', 'InterlockedPushListSList', 'InterlockedPushListSListEx', 'InvalidateConsoleDIBits', 'IsBadCodePtr', 'IsBadHugeReadPtr', 'IsBadHugeWritePtr', 'IsBadReadPtr', 'IsBadStringPtrA', 'IsBadStringPtrW', 'IsBadWritePtr', 'IsCalendarLeapDay', 'IsCalendarLeapMonth', 'IsCalendarLeapYear', 'IsDBCSLeadByte', 'IsDBCSLeadByteEx', 'IsDebuggerPresent', 'IsEnclaveTypeSupported', 'IsNLSDefinedString', 'IsNativeVhdBoot', 'IsNormalizedString', 'IsProcessCritical', 'IsProcessInJob', 'IsProcessorFeaturePresent', 'IsSystemResumeAutomatic', 'IsThreadAFiber', 'IsThreadpoolTimerSet', 'IsValidCalDateTime', 'IsValidCodePage', 'IsValidLanguageGroup', 'IsValidLocale', 'IsValidLocaleName', 'IsValidNLSVersion', 'IsWow64GuestMachineSupported', 'IsWow64Process', 'IsWow64Process2', 'K32EmptyWorkingSet', 'K32EnumDeviceDrivers', 'K32EnumPageFilesA', 'K32EnumPageFilesW', 'K32EnumProcessModules', 'K32EnumProcessModulesEx', 'K32EnumProcesses', 'K32GetDeviceDriverBaseNameA', 'K32GetDeviceDriverBaseNameW', 'K32GetDeviceDriverFileNameA', 'K32GetDeviceDriverFileNameW', 'K32GetMappedFileNameA', 'K32GetMappedFileNameW', 'K32GetModuleBaseNameA', 'K32GetModuleBaseNameW', 'K32GetModuleFileNameExA', 'K32GetModuleFileNameExW', 'K32GetModuleInformation', 'K32GetPerformanceInfo', 'K32GetProcessImageFileNameA', 'K32GetProcessImageFileNameW', 'K32GetProcessMemoryInfo', 'K32GetWsChanges', 'K32GetWsChangesEx', 'K32InitializeProcessForWsWatch', 'K32QueryWorkingSet', 'K32QueryWorkingSetEx', 'LCIDToLocaleName', 'LCMapStringA', 'LCMapStringEx', 'LCMapStringW', 'LZClose', 'LZCloseFile', 'LZCopy', 'LZCreateFileW', 'LZDone', 'LZInit', 'LZOpenFileA', 'LZOpenFileW', 'LZRead', 'LZSeek', 'LZStart', 'LeaveCriticalSection', 'LeaveCriticalSectionWhenCallbackReturns', 'LoadAppInitDlls', 'LoadEnclaveData', 'LoadLibraryA', 'LoadLibraryExA', 'LoadLibraryExW', 'LoadLibraryW', 'LoadModule', 'LoadPackagedLibrary', 'LoadResource', 'LoadStringBaseExW', 'LoadStringBaseW', 'LocalAlloc', 'LocalCompact', 'LocalFileTimeToFileTime', 'LocalFileTimeToLocalSystemTime', 'LocalFlags', 'LocalFree', 'LocalHandle', 'LocalLock', 'LocalReAlloc', 'LocalShrink', 'LocalSize', 'LocalSystemTimeToLocalFileTime', 'LocalUnlock', 'LocaleNameToLCID', 'LocateXStateFeature', 'LockFile', 'LockFileEx', 'LockResource', 'MapUserPhysicalPages', 'MapUserPhysicalPagesScatter', 'MapViewOfFile', 'MapViewOfFileEx', 'MapViewOfFileExNuma', 'MapViewOfFileFromApp', 'Module32First', 'Module32FirstW', 'Module32Next', 'Module32NextW', 'MoveFileA', 'MoveFileExA', 'MoveFileExW', 'MoveFileTransactedA', 'MoveFileTransactedW', 'MoveFileW', 'MoveFileWithProgressA', 'MoveFileWithProgressW', 'MulDiv', 'MultiByteToWideChar', 'NeedCurrentDirectoryForExePathA', 'NeedCurrentDirectoryForExePathW', 'NlsCheckPolicy', 'NlsEventDataDescCreate', 'NlsGetCacheUpdateCount', 'NlsUpdateLocale', 'NlsUpdateSystemLocale', 'NlsWriteEtwEvent', 'NormalizeString', 'NotifyMountMgr', 'NotifyUILanguageChange', 'NtVdm64CreateProcessInternalW', 'OOBEComplete', 'OfferVirtualMemory', 'OpenConsoleW', 'OpenConsoleWStub', 'OpenEventA', 'OpenEventW', 'OpenFile', 'OpenFileById', 'OpenFileMappingA', 'OpenFileMappingW', 'OpenJobObjectA', 'OpenJobObjectW', 'OpenMutexA', 'OpenMutexW', 'OpenPackageInfoByFullName', 'OpenPrivateNamespaceA', 'OpenPrivateNamespaceW', 'OpenProcess', 'OpenProcessToken', 'OpenProfileUserMapping', 'OpenSemaphoreA', 'OpenSemaphoreW', 'OpenState', 'OpenStateExplicit', 'OpenThread', 'OpenThreadToken', 'OpenWaitableTimerA', 'OpenWaitableTimerW', 'OutputDebugStringA', 'OutputDebugStringW', 'PackageFamilyNameFromFullName', 'PackageFamilyNameFromId', 'PackageFullNameFromId', 'PackageIdFromFullName', 'PackageNameAndPublisherIdFromFamilyName', 'ParseApplicationUserModelId', 'PeekConsoleInputA', 'PeekConsoleInputW', 'PeekNamedPipe', 'PostQueuedCompletionStatus', 'PowerClearRequest', 'PowerCreateRequest', 'PowerSetRequest', 'PrefetchVirtualMemory', 'PrepareTape', 'PrivCopyFileExW', 'PrivMoveFileIdentityW', 'Process32First', 'Process32FirstW', 'Process32Next', 'Process32NextW', 'ProcessIdToSessionId', 'PssCaptureSnapshot', 'PssDuplicateSnapshot', 'PssFreeSnapshot', 'PssQuerySnapshot', 'PssWalkMarkerCreate', 'PssWalkMarkerFree', 'PssWalkMarkerGetPosition', 'PssWalkMarkerRewind', 'PssWalkMarkerSeek', 'PssWalkMarkerSeekToBeginning', 'PssWalkMarkerSetPosition', 'PssWalkMarkerTell', 'PssWalkSnapshot', 'PulseEvent', 'PurgeComm', 'QueryActCtxSettingsW', 'QueryActCtxSettingsWWorker', 'QueryActCtxW', 'QueryActCtxWWorker', 'QueryDepthSList', 'QueryDosDeviceA', 'QueryDosDeviceW', 'QueryFullProcessImageNameA', 'QueryFullProcessImageNameW', 'QueryIdleProcessorCycleTime', 'QueryIdleProcessorCycleTimeEx', 'QueryInformationJobObject', 'QueryIoRateControlInformationJobObject', 'QueryMemoryResourceNotification', 'QueryPerformanceCounter', 'QueryPerformanceFrequency', 'QueryProcessAffinityUpdateMode', 'QueryProcessCycleTime', 'QueryProtectedPolicy', 'QueryThreadCycleTime', 'QueryThreadProfiling', 'QueryThreadpoolStackInformation', 'QueryUmsThreadInformation', 'QueryUnbiasedInterruptTime', 'QueueUserAPC', 'QueueUserWorkItem', 'QuirkGetData2Worker', 'QuirkGetDataWorker', 'QuirkIsEnabled2Worker', 'QuirkIsEnabled3Worker', 'QuirkIsEnabledForPackage2Worker', 'QuirkIsEnabledForPackage3Worker', 'QuirkIsEnabledForPackage4Worker', 'QuirkIsEnabledForPackageWorker', 'QuirkIsEnabledForProcessWorker', 'QuirkIsEnabledWorker', 'RaiseException', 'RaiseFailFastException', 'RaiseInvalid16BitExeError', 'ReOpenFile', 'ReadConsoleA', 'ReadConsoleInputA', 'ReadConsoleInputExA', 'ReadConsoleInputExW', 'ReadConsoleInputW', 'ReadConsoleOutputA', 'ReadConsoleOutputAttribute', 'ReadConsoleOutputCharacterA', 'ReadConsoleOutputCharacterW', 'ReadConsoleOutputW', 'ReadConsoleW', 'ReadDirectoryChangesExW', 'ReadDirectoryChangesW', 'ReadFile', 'ReadFileEx', 'ReadFileScatter', 'ReadProcessMemory', 'ReadThreadProfilingData', 'ReclaimVirtualMemory', 'RegCloseKey', 'RegCopyTreeW', 'RegCreateKeyExA', 'RegCreateKeyExW', 'RegDeleteKeyExA', 'RegDeleteKeyExW', 'RegDeleteTreeA', 'RegDeleteTreeW', 'RegDeleteValueA', 'RegDeleteValueW', 'RegDisablePredefinedCacheEx', 'RegEnumKeyExA', 'RegEnumKeyExW', 'RegEnumValueA', 'RegEnumValueW', 'RegFlushKey', 'RegGetKeySecurity', 'RegGetValueA', 'RegGetValueW', 'RegLoadKeyA', 'RegLoadKeyW', 'RegLoadMUIStringA', 'RegLoadMUIStringW', 'RegNotifyChangeKeyValue', 'RegOpenCurrentUser', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegOpenUserClassesRoot', 'RegQueryInfoKeyA', 'RegQueryInfoKeyW', 'RegQueryValueExA', 'RegQueryValueExW', 'RegRestoreKeyA', 'RegRestoreKeyW', 'RegSaveKeyExA', 'RegSaveKeyExW', 'RegSetKeySecurity', 'RegSetValueExA', 'RegSetValueExW', 'RegUnLoadKeyA', 'RegUnLoadKeyW', 'RegisterApplicationRecoveryCallback', 'RegisterApplicationRestart', 'RegisterBadMemoryNotification', 'RegisterConsoleIME', 'RegisterConsoleOS2', 'RegisterConsoleVDM', 'RegisterWaitForInputIdle', 'RegisterWaitForSingleObject', 'RegisterWaitForSingleObjectEx', 'RegisterWaitUntilOOBECompleted', 'RegisterWowBaseHandlers', 'RegisterWowExec', 'ReleaseActCtx', 'ReleaseActCtxWorker', 'ReleaseMutex', 'ReleaseMutexWhenCallbackReturns', 'ReleaseSRWLockExclusive', 'ReleaseSRWLockShared', 'ReleaseSemaphore', 'ReleaseSemaphoreWhenCallbackReturns', 'RemoveDirectoryA', 'RemoveDirectoryTransactedA', 'RemoveDirectoryTransactedW', 'RemoveDirectoryW', 'RemoveDllDirectory', 'RemoveLocalAlternateComputerNameA', 'RemoveLocalAlternateComputerNameW', 'RemoveSecureMemoryCacheCallback', 'RemoveVectoredContinueHandler', 'RemoveVectoredExceptionHandler', 'ReplaceFile', 'ReplaceFileA', 'ReplaceFileW', 'ReplacePartitionUnit', 'RequestDeviceWakeup', 'RequestWakeupLatency', 'ResetEvent', 'ResetWriteWatch', 'ResizePseudoConsole', 'ResolveDelayLoadedAPI', 'ResolveDelayLoadsFromDll', 'ResolveLocaleName', 'RestoreLastError', 'ResumeThread', 'RtlAddFunctionTable', 'RtlCaptureContext', 'RtlCaptureStackBackTrace', 'RtlCompareMemory', 'RtlCopyMemory', 'RtlDeleteFunctionTable', 'RtlFillMemory', 'RtlInstallFunctionTableCallback', 'RtlLookupFunctionEntry', 'RtlMoveMemory', 'RtlPcToFileHeader', 'RtlRaiseException', 'RtlRestoreContext', 'RtlUnwind', 'RtlUnwindEx', 'RtlVirtualUnwind', 'RtlZeroMemory', 'ScrollConsoleScreenBufferA', 'ScrollConsoleScreenBufferW', 'SearchPathA', 'SearchPathW', 'SetCachedSigningLevel', 'SetCalendarInfoA', 'SetCalendarInfoW', 'SetComPlusPackageInstallStatus', 'SetCommBreak', 'SetCommConfig', 'SetCommMask', 'SetCommState', 'SetCommTimeouts', 'SetComputerNameA', 'SetComputerNameEx2W', 'SetComputerNameExA', 'SetComputerNameExW', 'SetComputerNameW', 'SetConsoleActiveScreenBuffer', 'SetConsoleCP', 'SetConsoleCtrlHandler', 'SetConsoleCursor', 'SetConsoleCursorInfo', 'SetConsoleCursorMode', 'SetConsoleCursorPosition', 'SetConsoleDisplayMode', 'SetConsoleFont', 'SetConsoleHardwareState', 'SetConsoleHistoryInfo', 'SetConsoleIcon', 'SetConsoleInputExeNameA', 'SetConsoleInputExeNameW', 'SetConsoleKeyShortcuts', 'SetConsoleLocalEUDC', 'SetConsoleMaximumWindowSize', 'SetConsoleMenuClose', 'SetConsoleMode', 'SetConsoleNlsMode', 'SetConsoleNumberOfCommandsA', 'SetConsoleNumberOfCommandsW', 'SetConsoleOS2OemFormat', 'SetConsoleOutputCP', 'SetConsolePalette', 'SetConsoleScreenBufferInfoEx', 'SetConsoleScreenBufferSize', 'SetConsoleTextAttribute', 'SetConsoleTitleA', 'SetConsoleTitleW', 'SetConsoleWindowInfo', 'SetCriticalSectionSpinCount', 'SetCurrentConsoleFontEx', 'SetCurrentDirectoryA', 'SetCurrentDirectoryW', 'SetDefaultCommConfigA', 'SetDefaultCommConfigW', 'SetDefaultDllDirectories', 'SetDllDirectoryA', 'SetDllDirectoryW', 'SetDynamicTimeZoneInformation', 'SetEndOfFile', 'SetEnvironmentStringsA', 'SetEnvironmentStringsW', 'SetEnvironmentVariableA', 'SetEnvironmentVariableW', 'SetErrorMode', 'SetEvent', 'SetEventWhenCallbackReturns', 'SetFileApisToANSI', 'SetFileApisToOEM', 'SetFileAttributesA', 'SetFileAttributesTransactedA', 'SetFileAttributesTransactedW', 'SetFileAttributesW', 'SetFileBandwidthReservation', 'SetFileCompletionNotificationModes', 'SetFileInformationByHandle', 'SetFileIoOverlappedRange', 'SetFilePointer', 'SetFilePointerEx', 'SetFileShortNameA', 'SetFileShortNameW', 'SetFileTime', 'SetFileValidData', 'SetFirmwareEnvironmentVariableA', 'SetFirmwareEnvironmentVariableExA', 'SetFirmwareEnvironmentVariableExW', 'SetFirmwareEnvironmentVariableW', 'SetHandleCount', 'SetHandleInformation', 'SetInformationJobObject', 'SetIoRateControlInformationJobObject', 'SetLastConsoleEventActive', 'SetLastError', 'SetLocalPrimaryComputerNameA', 'SetLocalPrimaryComputerNameW', 'SetLocalTime', 'SetLocaleInfoA', 'SetLocaleInfoW', 'SetMailslotInfo', 'SetMessageWaitingIndicator', 'SetNamedPipeAttribute', 'SetNamedPipeHandleState', 'SetPriorityClass', 'SetProcessAffinityMask', 'SetProcessAffinityUpdateMode', 'SetProcessDEPPolicy', 'SetProcessDefaultCpuSets', 'SetProcessInformation', 'SetProcessMitigationPolicy', 'SetProcessPreferredUILanguages', 'SetProcessPriorityBoost', 'SetProcessShutdownParameters', 'SetProcessWorkingSetSize', 'SetProcessWorkingSetSizeEx', 'SetProtectedPolicy', 'SetSearchPathMode', 'SetStdHandle', 'SetStdHandleEx', 'SetSystemFileCacheSize', 'SetSystemPowerState', 'SetSystemTime', 'SetSystemTimeAdjustment', 'SetTapeParameters', 'SetTapePosition', 'SetTermsrvAppInstallMode', 'SetThreadAffinityMask', 'SetThreadContext', 'SetThreadDescription', 'SetThreadErrorMode', 'SetThreadExecutionState', 'SetThreadGroupAffinity', 'SetThreadIdealProcessor', 'SetThreadIdealProcessorEx', 'SetThreadInformation', 'SetThreadLocale', 'SetThreadPreferredUILanguages', 'SetThreadPriority', 'SetThreadPriorityBoost', 'SetThreadSelectedCpuSets', 'SetThreadStackGuarantee', 'SetThreadToken', 'SetThreadUILanguage', 'SetThreadpoolStackInformation', 'SetThreadpoolThreadMaximum', 'SetThreadpoolThreadMinimum', 'SetThreadpoolTimer', 'SetThreadpoolTimerEx', 'SetThreadpoolWait', 'SetThreadpoolWaitEx', 'SetTimeZoneInformation', 'SetTimerQueueTimer', 'SetUmsThreadInformation', 'SetUnhandledExceptionFilter', 'SetUserGeoID', 'SetUserGeoName', 'SetVDMCurrentDirectories', 'SetVolumeLabelA', 'SetVolumeLabelW', 'SetVolumeMountPointA', 'SetVolumeMountPointW', 'SetVolumeMountPointWStub', 'SetWaitableTimer', 'SetWaitableTimerEx', 'SetXStateFeaturesMask', 'SetupComm', 'ShowConsoleCursor', 'SignalObjectAndWait', 'SizeofResource', 'Sleep', 'SleepConditionVariableCS', 'SleepConditionVariableSRW', 'SleepEx', 'SortCloseHandle', 'SortGetHandle', 'StartThreadpoolIo', 'SubmitThreadpoolWork', 'SuspendThread', 'SwitchToFiber', 'SwitchToThread', 'SystemTimeToFileTime', 'SystemTimeToTzSpecificLocalTime', 'SystemTimeToTzSpecificLocalTimeEx', 'TerminateJobObject', 'TerminateProcess', 'TerminateThread', 'TermsrvAppInstallMode', 'TermsrvConvertSysRootToUserDir', 'TermsrvCreateRegEntry', 'TermsrvDeleteKey', 'TermsrvDeleteValue', 'TermsrvGetPreSetValue', 'TermsrvGetWindowsDirectoryA', 'TermsrvGetWindowsDirectoryW', 'TermsrvOpenRegEntry', 'TermsrvOpenUserClasses', 'TermsrvRestoreKey', 'TermsrvSetKeySecurity', 'TermsrvSetValueKey', 'TermsrvSyncUserIniFileExt', 'Thread32First', 'Thread32Next', 'TlsAlloc', 'TlsFree', 'TlsGetValue', 'TlsSetValue', 'Toolhelp32ReadProcessMemory', 'TransactNamedPipe', 'TransmitCommChar', 'TryAcquireSRWLockExclusive', 'TryAcquireSRWLockShared', 'TryEnterCriticalSection', 'TrySubmitThreadpoolCallback', 'TzSpecificLocalTimeToSystemTime', 'TzSpecificLocalTimeToSystemTimeEx', 'UTRegister', 'UTUnRegister', 'UmsThreadYield', 'UnhandledExceptionFilter', 'UnlockFile', 'UnlockFileEx', 'UnmapViewOfFile', 'UnmapViewOfFileEx', 'UnregisterApplicationRecoveryCallback', 'UnregisterApplicationRestart', 'UnregisterBadMemoryNotification', 'UnregisterConsoleIME', 'UnregisterWait', 'UnregisterWaitEx', 'UnregisterWaitUntilOOBECompleted', 'UpdateCalendarDayOfWeek', 'UpdateProcThreadAttribute', 'UpdateResourceA', 'UpdateResourceW', 'VDMConsoleOperation', 'VDMOperationStarted', 'VerLanguageNameA', 'VerLanguageNameW', 'VerSetConditionMask', 'VerifyConsoleIoHandle', 'VerifyScripts', 'VerifyVersionInfoA', 'VerifyVersionInfoW', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualAllocExNuma', 'VirtualFree', 'VirtualFreeEx', 'VirtualLock', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 'VirtualUnlock', 'WTSGetActiveConsoleSessionId', 'WaitCommEvent', 'WaitForDebugEvent', 'WaitForDebugEventEx', 'WaitForMultipleObjects', 'WaitForMultipleObjectsEx', 'WaitForSingleObject', 'WaitForSingleObjectEx', 'WaitForThreadpoolIoCallbacks', 'WaitForThreadpoolTimerCallbacks', 'WaitForThreadpoolWaitCallbacks', 'WaitForThreadpoolWorkCallbacks', 'WaitNamedPipeA', 'WaitNamedPipeW', 'WakeAllConditionVariable', 'WakeConditionVariable', 'WerGetFlags', 'WerGetFlagsWorker', 'WerRegisterAdditionalProcess', 'WerRegisterAppLocalDump', 'WerRegisterCustomMetadata', 'WerRegisterExcludedMemoryBlock', 'WerRegisterFile', 'WerRegisterFileWorker', 'WerRegisterMemoryBlock', 'WerRegisterMemoryBlockWorker', 'WerRegisterRuntimeExceptionModule', 'WerRegisterRuntimeExceptionModuleWorker', 'WerSetFlags', 'WerSetFlagsWorker', 'WerUnregisterAdditionalProcess', 'WerUnregisterAppLocalDump', 'WerUnregisterCustomMetadata', 'WerUnregisterExcludedMemoryBlock', 'WerUnregisterFile', 'WerUnregisterFileWorker', 'WerUnregisterMemoryBlock', 'WerUnregisterMemoryBlockWorker', 'WerUnregisterRuntimeExceptionModule', 'WerUnregisterRuntimeExceptionModuleWorker', 'WerpGetDebugger', 'WerpInitiateRemoteRecovery', 'WerpLaunchAeDebug', 'WerpNotifyLoadStringResourceWorker', 'WerpNotifyUseStringResourceWorker', 'WideCharToMultiByte', 'WinExec', 'Wow64DisableWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'Wow64GetThreadSelectorEntry', 'Wow64RevertWow64FsRedirection', 'Wow64SetThreadContext', 'Wow64SuspendThread', 'WriteConsoleA', 'WriteConsoleInputA', 'WriteConsoleInputVDMA', 'WriteConsoleInputVDMW', 'WriteConsoleInputW', 'WriteConsoleOutputA', 'WriteConsoleOutputAttribute', 'WriteConsoleOutputCharacterA', 'WriteConsoleOutputCharacterW', 'WriteConsoleOutputW', 'WriteConsoleW', 'WriteFile', 'WriteFileEx', 'WriteFileGather', 'WritePrivateProfileSectionA', 'WritePrivateProfileSectionW', 'WritePrivateProfileStringA', 'WritePrivateProfileStringW', 'WritePrivateProfileStructA', 'WritePrivateProfileStructW', 'WriteProcessMemory', 'WriteProfileSectionA', 'WriteProfileSectionW', 'WriteProfileStringA', 'WriteProfileStringW', 'WriteTapemark', 'ZombifyActCtx', 'ZombifyActCtxWorker', '__C_specific_handler', '__chkstk', '__misaligned_access', '_hread', '_hwrite', '_lclose', '_lcreat', '_llseek', '_local_unwind', '_lopen', '_lread', '_lwrite', 'lstrcat', 'lstrcatA', 'lstrcatW', 'lstrcmp', 'lstrcmpA', 'lstrcmpW', 'lstrcmpi', 'lstrcmpiA', 'lstrcmpiW', 'lstrcpy', 'lstrcpyA', 'lstrcpyW', 'lstrcpyn', 'lstrcpynA', 'lstrcpynW', 'lstrlen', 'lstrlenA', 'lstrlenW', 'timeBeginPeriod', 'timeEndPeriod', 'timeGetDevCaps', 'timeGetSystemTime', 'timeGetTime', 'uaw_lstrcmpW', 'uaw_lstrcmpiW', 'uaw_lstrlenW', 'uaw_wcschr', 'uaw_wcscpy', 'uaw_wcsicmp', 'uaw_wcslen', 'uaw_wcsrchr', 'A_SHAFinal', 'A_SHAInit', 'A_SHAUpdate', 'AlpcAdjustCompletionListConcurrencyCount', 'AlpcFreeCompletionListMessage', 'AlpcGetCompletionListLastMessageInformation', 'AlpcGetCompletionListMessageAttributes', 'AlpcGetHeaderSize', 'AlpcGetMessageAttribute', 'AlpcGetMessageFromCompletionList', 'AlpcGetOutstandingCompletionListMessageCount', 'AlpcInitializeMessageAttribute', 'AlpcMaxAllowedMessageLength', 'AlpcRegisterCompletionList', 'AlpcRegisterCompletionListWorkerThread', 'AlpcRundownCompletionList', 'AlpcUnregisterCompletionList', 'AlpcUnregisterCompletionListWorkerThread', 'ApiSetQueryApiSetPresence', 'ApiSetQueryApiSetPresenceEx', 'CsrAllocateCaptureBuffer', 'CsrAllocateMessagePointer', 'CsrCaptureMessageBuffer', 'CsrCaptureMessageMultiUnicodeStringsInPlace', 'CsrCaptureMessageString', 'CsrCaptureTimeout', 'CsrClientCallServer', 'CsrClientConnectToServer', 'CsrFreeCaptureBuffer', 'CsrGetProcessId', 'CsrIdentifyAlertableThread', 'CsrSetPriorityClass', 'CsrVerifyRegion', 'DbgBreakPoint', 'DbgPrint', 'DbgPrintEx', 'DbgPrintReturnControlC', 'DbgPrompt', 'DbgQueryDebugFilterState', 'DbgSetDebugFilterState', 'DbgUiConnectToDbg', 'DbgUiContinue', 'DbgUiConvertStateChangeStructure', 'DbgUiConvertStateChangeStructureEx', 'DbgUiDebugActiveProcess', 'DbgUiGetThreadDebugObject', 'DbgUiIssueRemoteBreakin', 'DbgUiRemoteBreakin', 'DbgUiSetThreadDebugObject', 'DbgUiStopDebugging', 'DbgUiWaitStateChange', 'DbgUserBreakPoint', 'EtwCheckCoverage', 'EtwCreateTraceInstanceId', 'EtwDeliverDataBlock', 'EtwEnumerateProcessRegGuids', 'EtwEventActivityIdControl', 'EtwEventEnabled', 'EtwEventProviderEnabled', 'EtwEventRegister', 'EtwEventSetInformation', 'EtwEventUnregister', 'EtwEventWrite', 'EtwEventWriteEndScenario', 'EtwEventWriteEx', 'EtwEventWriteFull', 'EtwEventWriteNoRegistration', 'EtwEventWriteStartScenario', 'EtwEventWriteString', 'EtwEventWriteTransfer', 'EtwGetTraceEnableFlags', 'EtwGetTraceEnableLevel', 'EtwGetTraceLoggerHandle', 'EtwLogTraceEvent', 'EtwNotificationRegister', 'EtwNotificationUnregister', 'EtwProcessPrivateLoggerRequest', 'EtwRegisterSecurityProvider', 'EtwRegisterTraceGuidsA', 'EtwRegisterTraceGuidsW', 'EtwReplyNotification', 'EtwSendNotification', 'EtwSetMark', 'EtwTraceEventInstance', 'EtwTraceMessage', 'EtwTraceMessageVa', 'EtwUnregisterTraceGuids', 'EtwWriteUMSecurityEvent', 'EtwpCreateEtwThread', 'EtwpGetCpuSpeed', 'EvtIntReportAuthzEventAndSourceAsync', 'EvtIntReportEventAndSourceAsync', 'ExpInterlockedPopEntrySListEnd', 'ExpInterlockedPopEntrySListFault', 'ExpInterlockedPopEntrySListResume', 'KiRaiseUserExceptionDispatcher', 'KiUserApcDispatcher', 'KiUserCallbackDispatcher', 'KiUserExceptionDispatcher', 'KiUserInvertedFunctionTable', 'LdrAccessResource', 'LdrAddDllDirectory', 'LdrAddLoadAsDataTable', 'LdrAddRefDll', 'LdrAppxHandleIntegrityFailure', 'LdrCallEnclave', 'LdrControlFlowGuardEnforced', 'LdrCreateEnclave', 'LdrDeleteEnclave', 'LdrDisableThreadCalloutsForDll', 'LdrEnumResources', 'LdrEnumerateLoadedModules', 'LdrFastFailInLoaderCallout', 'LdrFindEntryForAddress', 'LdrFindResourceDirectory_U', 'LdrFindResourceEx_U', 'LdrFindResource_U', 'LdrFlushAlternateResourceModules', 'LdrGetDllDirectory', 'LdrGetDllFullName', 'LdrGetDllHandle', 'LdrGetDllHandleByMapping', 'LdrGetDllHandleByName', 'LdrGetDllHandleEx', 'LdrGetDllPath', 'LdrGetFailureData', 'LdrGetFileNameFromLoadAsDataTable', 'LdrGetKnownDllSectionHandle', 'LdrGetProcedureAddress', 'LdrGetProcedureAddressEx', 'LdrGetProcedureAddressForCaller', 'LdrInitShimEngineDynamic', 'LdrInitializeEnclave', 'LdrInitializeThunk', 'LdrIsModuleSxsRedirected', 'LdrLoadAlternateResourceModule', 'LdrLoadAlternateResourceModuleEx', 'LdrLoadDll', 'LdrLoadEnclaveModule', 'LdrLockLoaderLock', 'LdrOpenImageFileOptionsKey', 'LdrProcessInitializationComplete', 'LdrProcessRelocationBlock', 'LdrProcessRelocationBlockEx', 'LdrQueryImageFileExecutionOptions', 'LdrQueryImageFileExecutionOptionsEx', 'LdrQueryImageFileKeyOption', 'LdrQueryModuleServiceTags', 'LdrQueryOptionalDelayLoadedAPI', 'LdrQueryProcessModuleInformation', 'LdrRegisterDllNotification', 'LdrRemoveDllDirectory', 'LdrRemoveLoadAsDataTable', 'LdrResFindResource', 'LdrResFindResourceDirectory', 'LdrResGetRCConfig', 'LdrResRelease', 'LdrResSearchResource', 'LdrResolveDelayLoadedAPI', 'LdrResolveDelayLoadsFromDll', 'LdrRscIsTypeExist', 'LdrSetAppCompatDllRedirectionCallback', 'LdrSetDefaultDllDirectories', 'LdrSetDllDirectory', 'LdrSetDllManifestProber', 'LdrSetImplicitPathOptions', 'LdrSetMUICacheType', 'LdrShutdownProcess', 'LdrShutdownThread', 'LdrStandardizeSystemPath', 'LdrSystemDllInitBlock', 'LdrUnloadAlternateResourceModule', 'LdrUnloadAlternateResourceModuleEx', 'LdrUnloadDll', 'LdrUnlockLoaderLock', 'LdrUnregisterDllNotification', 'LdrUpdatePackageSearchPath', 'LdrVerifyImageMatchesChecksum', 'LdrVerifyImageMatchesChecksumEx', 'LdrpResGetMappingSize', 'LdrpResGetResourceDirectory', 'MD4Final', 'MD4Init', 'MD4Update', 'MD5Final', 'MD5Init', 'MD5Update', 'NlsAnsiCodePage', 'NlsMbCodePageTag', 'NlsMbOemCodePageTag', 'NtAcceptConnectPort', 'NtAccessCheck', 'NtAccessCheckAndAuditAlarm', 'NtAccessCheckByType', 'NtAccessCheckByTypeAndAuditAlarm', 'NtAccessCheckByTypeResultList', 'NtAccessCheckByTypeResultListAndAuditAlarm', 'NtAccessCheckByTypeResultListAndAuditAlarmByHandle', 'NtAcquireProcessActivityReference', 'NtAddAtom', 'NtAddAtomEx', 'NtAddBootEntry', 'NtAddDriverEntry', 'NtAdjustGroupsToken', 'NtAdjustPrivilegesToken', 'NtAdjustTokenClaimsAndDeviceGroups', 'NtAlertResumeThread', 'NtAlertThread', 'NtAlertThreadByThreadId', 'NtAllocateLocallyUniqueId', 'NtAllocateReserveObject', 'NtAllocateUserPhysicalPages', 'NtAllocateUuids', 'NtAllocateVirtualMemory', 'NtAllocateVirtualMemoryEx', 'NtAlpcAcceptConnectPort', 'NtAlpcCancelMessage', 'NtAlpcConnectPort', 'NtAlpcConnectPortEx', 'NtAlpcCreatePort', 'NtAlpcCreatePortSection', 'NtAlpcCreateResourceReserve', 'NtAlpcCreateSectionView', 'NtAlpcCreateSecurityContext', 'NtAlpcDeletePortSection', 'NtAlpcDeleteResourceReserve', 'NtAlpcDeleteSectionView', 'NtAlpcDeleteSecurityContext', 'NtAlpcDisconnectPort', 'NtAlpcImpersonateClientContainerOfPort', 'NtAlpcImpersonateClientOfPort', 'NtAlpcOpenSenderProcess', 'NtAlpcOpenSenderThread', 'NtAlpcQueryInformation', 'NtAlpcQueryInformationMessage', 'NtAlpcRevokeSecurityContext', 'NtAlpcSendWaitReceivePort', 'NtAlpcSetInformation', 'NtApphelpCacheControl', 'NtAreMappedFilesTheSame', 'NtAssignProcessToJobObject', 'NtAssociateWaitCompletionPacket', 'NtCallEnclave', 'NtCallbackReturn', 'NtCancelIoFile', 'NtCancelIoFileEx', 'NtCancelSynchronousIoFile', 'NtCancelTimer', 'NtCancelTimer2', 'NtCancelWaitCompletionPacket', 'NtClearEvent', 'NtClose', 'NtCloseObjectAuditAlarm', 'NtCommitComplete', 'NtCommitEnlistment', 'NtCommitRegistryTransaction', 'NtCommitTransaction', 'NtCompactKeys', 'NtCompareObjects', 'NtCompareSigningLevels', 'NtCompareTokens', 'NtCompleteConnectPort', 'NtCompressKey', 'NtConnectPort', 'NtContinue', 'NtConvertBetweenAuxiliaryCounterAndPerformanceCounter', 'NtCreateDebugObject', 'NtCreateDirectoryObject', 'NtCreateDirectoryObjectEx', 'NtCreateEnclave', 'NtCreateEnlistment', 'NtCreateEvent', 'NtCreateEventPair', 'NtCreateFile', 'NtCreateIRTimer', 'NtCreateIoCompletion', 'NtCreateJobObject', 'NtCreateJobSet', 'NtCreateKey', 'NtCreateKeyTransacted', 'NtCreateKeyedEvent', 'NtCreateLowBoxToken', 'NtCreateMailslotFile', 'NtCreateMutant', 'NtCreateNamedPipeFile', 'NtCreatePagingFile', 'NtCreatePartition', 'NtCreatePort', 'NtCreatePrivateNamespace', 'NtCreateProcess', 'NtCreateProcessEx', 'NtCreateProfile', 'NtCreateProfileEx', 'NtCreateRegistryTransaction', 'NtCreateResourceManager', 'NtCreateSection', 'NtCreateSectionEx', 'NtCreateSemaphore', 'NtCreateSymbolicLinkObject', 'NtCreateThread', 'NtCreateThreadEx', 'NtCreateTimer', 'NtCreateTimer2', 'NtCreateToken', 'NtCreateTokenEx', 'NtCreateTransaction', 'NtCreateTransactionManager', 'NtCreateUserProcess', 'NtCreateWaitCompletionPacket', 'NtCreateWaitablePort', 'NtCreateWnfStateName', 'NtCreateWorkerFactory', 'NtDebugActiveProcess', 'NtDebugContinue', 'NtDelayExecution', 'NtDeleteAtom', 'NtDeleteBootEntry', 'NtDeleteDriverEntry', 'NtDeleteFile', 'NtDeleteKey', 'NtDeleteObjectAuditAlarm', 'NtDeletePrivateNamespace', 'NtDeleteValueKey', 'NtDeleteWnfStateData', 'NtDeleteWnfStateName', 'NtDeviceIoControlFile', 'NtDisableLastKnownGood', 'NtDisplayString', 'NtDrawText', 'NtDuplicateObject', 'NtDuplicateToken', 'NtEnableLastKnownGood', 'NtEnumerateBootEntries', 'NtEnumerateDriverEntries', 'NtEnumerateKey', 'NtEnumerateSystemEnvironmentValuesEx', 'NtEnumerateTransactionObject', 'NtEnumerateValueKey', 'NtExtendSection', 'NtFilterBootOption', 'NtFilterToken', 'NtFilterTokenEx', 'NtFindAtom', 'NtFlushBuffersFile', 'NtFlushBuffersFileEx', 'NtFlushInstallUILanguage', 'NtFlushInstructionCache', 'NtFlushKey', 'NtFlushProcessWriteBuffers', 'NtFlushVirtualMemory', 'NtFlushWriteBuffer', 'NtFreeUserPhysicalPages', 'NtFreeVirtualMemory', 'NtFreezeRegistry', 'NtFreezeTransactions', 'NtFsControlFile', 'NtGetCachedSigningLevel', 'NtGetCompleteWnfStateSubscription', 'NtGetContextThread', 'NtGetCurrentProcessorNumber', 'NtGetCurrentProcessorNumberEx', 'NtGetDevicePowerState', 'NtGetMUIRegistryInfo', 'NtGetNextProcess', 'NtGetNextThread', 'NtGetNlsSectionPtr', 'NtGetNotificationResourceManager', 'NtGetTickCount', 'NtGetWriteWatch', 'NtImpersonateAnonymousToken', 'NtImpersonateClientOfPort', 'NtImpersonateThread', 'NtInitializeEnclave', 'NtInitializeNlsFiles', 'NtInitializeRegistry', 'NtInitiatePowerAction', 'NtIsProcessInJob', 'NtIsSystemResumeAutomatic', 'NtIsUILanguageComitted', 'NtListenPort', 'NtLoadDriver', 'NtLoadEnclaveData', 'NtLoadKey', 'NtLoadKey2', 'NtLoadKeyEx', 'NtLockFile', 'NtLockProductActivationKeys', 'NtLockRegistryKey', 'NtLockVirtualMemory', 'NtMakePermanentObject', 'NtMakeTemporaryObject', 'NtManageHotPatch', 'NtManagePartition', 'NtMapCMFModule', 'NtMapUserPhysicalPages', 'NtMapUserPhysicalPagesScatter', 'NtMapViewOfSection', 'NtMapViewOfSectionEx', 'NtModifyBootEntry', 'NtModifyDriverEntry', 'NtNotifyChangeDirectoryFile', 'NtNotifyChangeDirectoryFileEx', 'NtNotifyChangeKey', 'NtNotifyChangeMultipleKeys', 'NtNotifyChangeSession', 'NtOpenDirectoryObject', 'NtOpenEnlistment', 'NtOpenEvent', 'NtOpenEventPair', 'NtOpenFile', 'NtOpenIoCompletion', 'NtOpenJobObject', 'NtOpenKey', 'NtOpenKeyEx', 'NtOpenKeyTransacted', 'NtOpenKeyTransactedEx', 'NtOpenKeyedEvent', 'NtOpenMutant', 'NtOpenObjectAuditAlarm', 'NtOpenPartition', 'NtOpenPrivateNamespace', 'NtOpenProcess', 'NtOpenProcessToken', 'NtOpenProcessTokenEx', 'NtOpenRegistryTransaction', 'NtOpenResourceManager', 'NtOpenSection', 'NtOpenSemaphore', 'NtOpenSession', 'NtOpenSymbolicLinkObject', 'NtOpenThread', 'NtOpenThreadToken', 'NtOpenThreadTokenEx', 'NtOpenTimer', 'NtOpenTransaction', 'NtOpenTransactionManager', 'NtPlugPlayControl', 'NtPowerInformation', 'NtPrePrepareComplete', 'NtPrePrepareEnlistment', 'NtPrepareComplete', 'NtPrepareEnlistment', 'NtPrivilegeCheck', 'NtPrivilegeObjectAuditAlarm', 'NtPrivilegedServiceAuditAlarm', 'NtPropagationComplete', 'NtPropagationFailed', 'NtProtectVirtualMemory', 'NtPulseEvent', 'NtQueryAttributesFile', 'NtQueryAuxiliaryCounterFrequency', 'NtQueryBootEntryOrder', 'NtQueryBootOptions', 'NtQueryDebugFilterState', 'NtQueryDefaultLocale', 'NtQueryDefaultUILanguage', 'NtQueryDirectoryFile', 'NtQueryDirectoryFileEx', 'NtQueryDirectoryObject', 'NtQueryDriverEntryOrder', 'NtQueryEaFile', 'NtQueryEvent', 'NtQueryFullAttributesFile', 'NtQueryInformationAtom', 'NtQueryInformationByName', 'NtQueryInformationEnlistment', 'NtQueryInformationFile', 'NtQueryInformationJobObject', 'NtQueryInformationPort', 'NtQueryInformationProcess', 'NtQueryInformationResourceManager', 'NtQueryInformationThread', 'NtQueryInformationToken', 'NtQueryInformationTransaction', 'NtQueryInformationTransactionManager', 'NtQueryInformationWorkerFactory', 'NtQueryInstallUILanguage', 'NtQueryIntervalProfile', 'NtQueryIoCompletion', 'NtQueryKey', 'NtQueryLicenseValue', 'NtQueryMultipleValueKey', 'NtQueryMutant', 'NtQueryObject', 'NtQueryOpenSubKeys', 'NtQueryOpenSubKeysEx', 'NtQueryPerformanceCounter', 'NtQueryPortInformationProcess', 'NtQueryQuotaInformationFile', 'NtQuerySection', 'NtQuerySecurityAttributesToken', 'NtQuerySecurityObject', 'NtQuerySecurityPolicy', 'NtQuerySemaphore', 'NtQuerySymbolicLinkObject', 'NtQuerySystemEnvironmentValue', 'NtQuerySystemEnvironmentValueEx', 'NtQuerySystemInformation', 'NtQuerySystemInformationEx', 'NtQuerySystemTime', 'NtQueryTimer', 'NtQueryTimerResolution', 'NtQueryValueKey', 'NtQueryVirtualMemory', 'NtQueryVolumeInformationFile', 'NtQueryWnfStateData', 'NtQueryWnfStateNameInformation', 'NtQueueApcThread', 'NtQueueApcThreadEx', 'NtRaiseException', 'NtRaiseHardError', 'NtReadFile', 'NtReadFileScatter', 'NtReadOnlyEnlistment', 'NtReadRequestData', 'NtReadVirtualMemory', 'NtRecoverEnlistment', 'NtRecoverResourceManager', 'NtRecoverTransactionManager', 'NtRegisterProtocolAddressInformation', 'NtRegisterThreadTerminatePort', 'NtReleaseKeyedEvent', 'NtReleaseMutant', 'NtReleaseSemaphore', 'NtReleaseWorkerFactoryWorker', 'NtRemoveIoCompletion', 'NtRemoveIoCompletionEx', 'NtRemoveProcessDebug', 'NtRenameKey', 'NtRenameTransactionManager', 'NtReplaceKey', 'NtReplacePartitionUnit', 'NtReplyPort', 'NtReplyWaitReceivePort', 'NtReplyWaitReceivePortEx', 'NtReplyWaitReplyPort', 'NtRequestPort', 'NtRequestWaitReplyPort', 'NtResetEvent', 'NtResetWriteWatch', 'NtRestoreKey', 'NtResumeProcess', 'NtResumeThread', 'NtRevertContainerImpersonation', 'NtRollbackComplete', 'NtRollbackEnlistment', 'NtRollbackRegistryTransaction', 'NtRollbackTransaction', 'NtRollforwardTransactionManager', 'NtSaveKey', 'NtSaveKeyEx', 'NtSaveMergedKeys', 'NtSecureConnectPort', 'NtSerializeBoot', 'NtSetBootEntryOrder', 'NtSetBootOptions', 'NtSetCachedSigningLevel', 'NtSetCachedSigningLevel2', 'NtSetContextThread', 'NtSetDebugFilterState', 'NtSetDefaultHardErrorPort', 'NtSetDefaultLocale', 'NtSetDefaultUILanguage', 'NtSetDriverEntryOrder', 'NtSetEaFile', 'NtSetEvent', 'NtSetEventBoostPriority', 'NtSetHighEventPair', 'NtSetHighWaitLowEventPair', 'NtSetIRTimer', 'NtSetInformationDebugObject', 'NtSetInformationEnlistment', 'NtSetInformationFile', 'NtSetInformationJobObject', 'NtSetInformationKey', 'NtSetInformationObject', 'NtSetInformationProcess', 'NtSetInformationResourceManager', 'NtSetInformationSymbolicLink', 'NtSetInformationThread', 'NtSetInformationToken', 'NtSetInformationTransaction', 'NtSetInformationTransactionManager', 'NtSetInformationVirtualMemory', 'NtSetInformationWorkerFactory', 'NtSetIntervalProfile', 'NtSetIoCompletion', 'NtSetIoCompletionEx', 'NtSetLdtEntries', 'NtSetLowEventPair', 'NtSetLowWaitHighEventPair', 'NtSetQuotaInformationFile', 'NtSetSecurityObject', 'NtSetSystemEnvironmentValue', 'NtSetSystemEnvironmentValueEx', 'NtSetSystemInformation', 'NtSetSystemPowerState', 'NtSetSystemTime', 'NtSetThreadExecutionState', 'NtSetTimer', 'NtSetTimer2', 'NtSetTimerEx', 'NtSetTimerResolution', 'NtSetUuidSeed', 'NtSetValueKey', 'NtSetVolumeInformationFile', 'NtSetWnfProcessNotificationEvent', 'NtShutdownSystem', 'NtShutdownWorkerFactory', 'NtSignalAndWaitForSingleObject', 'NtSinglePhaseReject', 'NtStartProfile', 'NtStopProfile', 'NtSubscribeWnfStateChange', 'NtSuspendProcess', 'NtSuspendThread', 'NtSystemDebugControl', 'NtTerminateEnclave', 'NtTerminateJobObject', 'NtTerminateProcess', 'NtTerminateThread', 'NtTestAlert', 'NtThawRegistry', 'NtThawTransactions', 'NtTraceControl', 'NtTraceEvent', 'NtTranslateFilePath', 'NtUmsThreadYield', 'NtUnloadDriver', 'NtUnloadKey', 'NtUnloadKey2', 'NtUnloadKeyEx', 'NtUnlockFile', 'NtUnlockVirtualMemory', 'NtUnmapViewOfSection', 'NtUnmapViewOfSectionEx', 'NtUnsubscribeWnfStateChange', 'NtUpdateWnfStateData', 'NtVdmControl', 'NtWaitForAlertByThreadId', 'NtWaitForDebugEvent', 'NtWaitForKeyedEvent', 'NtWaitForMultipleObjects', 'NtWaitForMultipleObjects32', 'NtWaitForSingleObject', 'NtWaitForWorkViaWorkerFactory', 'NtWaitHighEventPair', 'NtWaitLowEventPair', 'NtWorkerFactoryWorkerReady', 'NtWriteFile', 'NtWriteFileGather', 'NtWriteRequestData', 'NtWriteVirtualMemory', 'NtYieldExecution', 'NtdllDefWindowProc_A', 'NtdllDefWindowProc_W', 'NtdllDialogWndProc_A', 'NtdllDialogWndProc_W', 'PfxFindPrefix', 'PfxInitialize', 'PfxInsertPrefix', 'PfxRemovePrefix', 'PssNtCaptureSnapshot', 'PssNtDuplicateSnapshot', 'PssNtFreeRemoteSnapshot', 'PssNtFreeSnapshot', 'PssNtFreeWalkMarker', 'PssNtQuerySnapshot', 'PssNtValidateDescriptor', 'PssNtWalkSnapshot', 'RtlAbortRXact', 'RtlAbsoluteToSelfRelativeSD', 'RtlAcquirePebLock', 'RtlAcquirePrivilege', 'RtlAcquireReleaseSRWLockExclusive', 'RtlAcquireResourceExclusive', 'RtlAcquireResourceShared', 'RtlAcquireSRWLockExclusive', 'RtlAcquireSRWLockShared', 'RtlActivateActivationContext', 'RtlActivateActivationContextEx', 'RtlActivateActivationContextUnsafeFast', 'RtlAddAccessAllowedAce', 'RtlAddAccessAllowedAceEx', 'RtlAddAccessAllowedObjectAce', 'RtlAddAccessDeniedAce', 'RtlAddAccessDeniedAceEx', 'RtlAddAccessDeniedObjectAce', 'RtlAddAccessFilterAce', 'RtlAddAce', 'RtlAddActionToRXact', 'RtlAddAtomToAtomTable', 'RtlAddAttributeActionToRXact', 'RtlAddAuditAccessAce', 'RtlAddAuditAccessAceEx', 'RtlAddAuditAccessObjectAce', 'RtlAddCompoundAce', 'RtlAddFunctionTable', 'RtlAddGrowableFunctionTable', 'RtlAddIntegrityLabelToBoundaryDescriptor', 'RtlAddMandatoryAce', 'RtlAddProcessTrustLabelAce', 'RtlAddRefActivationContext', 'RtlAddRefMemoryStream', 'RtlAddResourceAttributeAce', 'RtlAddSIDToBoundaryDescriptor', 'RtlAddScopedPolicyIDAce', 'RtlAddVectoredContinueHandler', 'RtlAddVectoredExceptionHandler', 'RtlAddressInSectionTable', 'RtlAdjustPrivilege', 'RtlAllocateActivationContextStack', 'RtlAllocateAndInitializeSid', 'RtlAllocateAndInitializeSidEx', 'RtlAllocateHandle', 'RtlAllocateHeap', 'RtlAllocateMemoryBlockLookaside', 'RtlAllocateMemoryZone', 'RtlAllocateWnfSerializationGroup', 'RtlAnsiCharToUnicodeChar', 'RtlAnsiStringToUnicodeSize', 'RtlAnsiStringToUnicodeString', 'RtlAppendAsciizToString', 'RtlAppendPathElement', 'RtlAppendStringToString', 'RtlAppendUnicodeStringToString', 'RtlAppendUnicodeToString', 'RtlApplicationVerifierStop', 'RtlApplyRXact', 'RtlApplyRXactNoFlush', 'RtlAppxIsFileOwnedByTrustedInstaller', 'RtlAreAllAccessesGranted', 'RtlAreAnyAccessesGranted', 'RtlAreBitsClear', 'RtlAreBitsSet', 'RtlAreLongPathsEnabled', 'RtlAssert', 'RtlAvlInsertNodeEx', 'RtlAvlRemoveNode', 'RtlBarrier', 'RtlBarrierForDelete', 'RtlCallEnclaveReturn', 'RtlCancelTimer', 'RtlCanonicalizeDomainName', 'RtlCapabilityCheck', 'RtlCapabilityCheckForSingleSessionSku', 'RtlCaptureContext', 'RtlCaptureStackBackTrace', 'RtlCharToInteger', 'RtlCheckBootStatusIntegrity', 'RtlCheckForOrphanedCriticalSections', 'RtlCheckPortableOperatingSystem', 'RtlCheckRegistryKey', 'RtlCheckSandboxedToken', 'RtlCheckSystemBootStatusIntegrity', 'RtlCheckTokenCapability', 'RtlCheckTokenMembership', 'RtlCheckTokenMembershipEx', 'RtlCleanUpTEBLangLists', 'RtlClearAllBits', 'RtlClearBit', 'RtlClearBits', 'RtlClearThreadWorkOnBehalfTicket', 'RtlCloneMemoryStream', 'RtlCloneUserProcess', 'RtlCmDecodeMemIoResource', 'RtlCmEncodeMemIoResource', 'RtlCommitDebugInfo', 'RtlCommitMemoryStream', 'RtlCompactHeap', 'RtlCompareAltitudes', 'RtlCompareMemory', 'RtlCompareMemoryUlong', 'RtlCompareString', 'RtlCompareUnicodeString', 'RtlCompareUnicodeStrings', 'RtlCompleteProcessCloning', 'RtlCompressBuffer', 'RtlComputeCrc32', 'RtlComputeImportTableHash', 'RtlComputePrivatizedDllName_U', 'RtlConnectToSm', 'RtlConsoleMultiByteToUnicodeN', 'RtlContractHashTable', 'RtlConvertDeviceFamilyInfoToString', 'RtlConvertExclusiveToShared', 'RtlConvertLCIDToString', 'RtlConvertSRWLockExclusiveToShared', 'RtlConvertSharedToExclusive', 'RtlConvertSidToUnicodeString', 'RtlConvertToAutoInheritSecurityObject', 'RtlCopyBitMap', 'RtlCopyContext', 'RtlCopyExtendedContext', 'RtlCopyLuid', 'RtlCopyLuidAndAttributesArray', 'RtlCopyMappedMemory', 'RtlCopyMemory', 'RtlCopyMemoryNonTemporal', 'RtlCopyMemoryStreamTo', 'RtlCopyOutOfProcessMemoryStreamTo', 'RtlCopySecurityDescriptor', 'RtlCopySid', 'RtlCopySidAndAttributesArray', 'RtlCopyString', 'RtlCopyUnicodeString', 'RtlCrc32', 'RtlCrc64', 'RtlCreateAcl', 'RtlCreateActivationContext', 'RtlCreateAndSetSD', 'RtlCreateAtomTable', 'RtlCreateBootStatusDataFile', 'RtlCreateBoundaryDescriptor', 'RtlCreateEnvironment', 'RtlCreateEnvironmentEx', 'RtlCreateHashTable', 'RtlCreateHashTableEx', 'RtlCreateHeap', 'RtlCreateMemoryBlockLookaside', 'RtlCreateMemoryZone', 'RtlCreateProcessParameters', 'RtlCreateProcessParametersEx', 'RtlCreateProcessParametersWithTemplate', 'RtlCreateProcessReflection', 'RtlCreateQueryDebugBuffer', 'RtlCreateRegistryKey', 'RtlCreateSecurityDescriptor', 'RtlCreateServiceSid', 'RtlCreateSystemVolumeInformationFolder', 'RtlCreateTagHeap', 'RtlCreateTimer', 'RtlCreateTimerQueue', 'RtlCreateUmsCompletionList', 'RtlCreateUmsThreadContext', 'RtlCreateUnicodeString', 'RtlCreateUnicodeStringFromAsciiz', 'RtlCreateUserProcess', 'RtlCreateUserProcessEx', 'RtlCreateUserSecurityObject', 'RtlCreateUserStack', 'RtlCreateUserThread', 'RtlCreateVirtualAccountSid', 'RtlCultureNameToLCID', 'RtlCustomCPToUnicodeN', 'RtlCutoverTimeToSystemTime', 'RtlDeCommitDebugInfo', 'RtlDeNormalizeProcessParams', 'RtlDeactivateActivationContext', 'RtlDeactivateActivationContextUnsafeFast', 'RtlDebugPrintTimes', 'RtlDecodePointer', 'RtlDecodeRemotePointer', 'RtlDecodeSystemPointer', 'RtlDecompressBuffer', 'RtlDecompressBufferEx', 'RtlDecompressFragment', 'RtlDefaultNpAcl', 'RtlDelete', 'RtlDeleteAce', 'RtlDeleteAtomFromAtomTable', 'RtlDeleteBarrier', 'RtlDeleteBoundaryDescriptor', 'RtlDeleteCriticalSection', 'RtlDeleteElementGenericTable', 'RtlDeleteElementGenericTableAvl', 'RtlDeleteElementGenericTableAvlEx', 'RtlDeleteFunctionTable', 'RtlDeleteGrowableFunctionTable', 'RtlDeleteHashTable', 'RtlDeleteNoSplay', 'RtlDeleteRegistryValue', 'RtlDeleteResource', 'RtlDeleteSecurityObject', 'RtlDeleteTimer', 'RtlDeleteTimerQueue', 'RtlDeleteTimerQueueEx', 'RtlDeleteUmsCompletionList', 'RtlDeleteUmsThreadContext', 'RtlDequeueUmsCompletionListItems', 'RtlDeregisterSecureMemoryCacheCallback', 'RtlDeregisterWait', 'RtlDeregisterWaitEx', 'RtlDeriveCapabilitySidsFromName', 'RtlDestroyAtomTable', 'RtlDestroyEnvironment', 'RtlDestroyHandleTable', 'RtlDestroyHeap', 'RtlDestroyMemoryBlockLookaside', 'RtlDestroyMemoryZone', 'RtlDestroyProcessParameters', 'RtlDestroyQueryDebugBuffer', 'RtlDetectHeapLeaks', 'RtlDetermineDosPathNameType_U', 'RtlDisableThreadProfiling', 'RtlDllShutdownInProgress', 'RtlDnsHostNameToComputerName', 'RtlDoesFileExists_U', 'RtlDosApplyFileIsolationRedirection_Ustr', 'RtlDosLongPathNameToNtPathName_U_WithStatus', 'RtlDosLongPathNameToRelativeNtPathName_U_WithStatus', 'RtlDosPathNameToNtPathName_U', 'RtlDosPathNameToNtPathName_U_WithStatus', 'RtlDosPathNameToRelativeNtPathName_U', 'RtlDosPathNameToRelativeNtPathName_U_WithStatus', 'RtlDosSearchPath_U', 'RtlDosSearchPath_Ustr', 'RtlDowncaseUnicodeChar', 'RtlDowncaseUnicodeString', 'RtlDrainNonVolatileFlush', 'RtlDumpResource', 'RtlDuplicateUnicodeString', 'RtlEmptyAtomTable', 'RtlEnableEarlyCriticalSectionEventCreation', 'RtlEnableThreadProfiling', 'RtlEnclaveCallDispatch', 'RtlEnclaveCallDispatchReturn', 'RtlEncodePointer', 'RtlEncodeRemotePointer', 'RtlEncodeSystemPointer', 'RtlEndEnumerationHashTable', 'RtlEndStrongEnumerationHashTable', 'RtlEndWeakEnumerationHashTable', 'RtlEnterCriticalSection', 'RtlEnterUmsSchedulingMode', 'RtlEnumProcessHeaps', 'RtlEnumerateEntryHashTable', 'RtlEnumerateGenericTable', 'RtlEnumerateGenericTableAvl', 'RtlEnumerateGenericTableLikeADirectory', 'RtlEnumerateGenericTableWithoutSplaying', 'RtlEnumerateGenericTableWithoutSplayingAvl', 'RtlEqualComputerName', 'RtlEqualDomainName', 'RtlEqualLuid', 'RtlEqualPrefixSid', 'RtlEqualSid', 'RtlEqualString', 'RtlEqualUnicodeString', 'RtlEqualWnfChangeStamps', 'RtlEraseUnicodeString', 'RtlEthernetAddressToStringA', 'RtlEthernetAddressToStringW', 'RtlEthernetStringToAddressA', 'RtlEthernetStringToAddressW', 'RtlExecuteUmsThread', 'RtlExitUserProcess', 'RtlExitUserThread', 'RtlExpandEnvironmentStrings', 'RtlExpandEnvironmentStrings_U', 'RtlExpandHashTable', 'RtlExtendCorrelationVector', 'RtlExtendMemoryBlockLookaside', 'RtlExtendMemoryZone', 'RtlExtractBitMap', 'RtlFillMemory', 'RtlFinalReleaseOutOfProcessMemoryStream', 'RtlFindAceByType', 'RtlFindActivationContextSectionGuid', 'RtlFindActivationContextSectionString', 'RtlFindCharInUnicodeString', 'RtlFindClearBits', 'RtlFindClearBitsAndSet', 'RtlFindClearRuns', 'RtlFindClosestEncodableLength', 'RtlFindExportedRoutineByName', 'RtlFindLastBackwardRunClear', 'RtlFindLeastSignificantBit', 'RtlFindLongestRunClear', 'RtlFindMessage', 'RtlFindMostSignificantBit', 'RtlFindNextForwardRunClear', 'RtlFindSetBits', 'RtlFindSetBitsAndClear', 'RtlFindUnicodeSubstring', 'RtlFirstEntrySList', 'RtlFirstFreeAce', 'RtlFlsAlloc', 'RtlFlsFree', 'RtlFlushHeaps', 'RtlFlushNonVolatileMemory', 'RtlFlushNonVolatileMemoryRanges', 'RtlFlushSecureMemoryCache', 'RtlFormatCurrentUserKeyPath', 'RtlFormatMessage', 'RtlFormatMessageEx', 'RtlFreeActivationContextStack', 'RtlFreeAnsiString', 'RtlFreeHandle', 'RtlFreeHeap', 'RtlFreeMemoryBlockLookaside', 'RtlFreeNonVolatileToken', 'RtlFreeOemString', 'RtlFreeSid', 'RtlFreeThreadActivationContextStack', 'RtlFreeUnicodeString', 'RtlFreeUserStack', 'RtlGUIDFromString', 'RtlGenerate8dot3Name', 'RtlGetAce', 'RtlGetActiveActivationContext', 'RtlGetActiveConsoleId', 'RtlGetAppContainerNamedObjectPath', 'RtlGetAppContainerParent', 'RtlGetAppContainerSidType', 'RtlGetCallersAddress', 'RtlGetCompressionWorkSpaceSize', 'RtlGetConsoleSessionForegroundProcessId', 'RtlGetControlSecurityDescriptor', 'RtlGetCriticalSectionRecursionCount', 'RtlGetCurrentDirectory_U', 'RtlGetCurrentPeb', 'RtlGetCurrentProcessorNumber', 'RtlGetCurrentProcessorNumberEx', 'RtlGetCurrentServiceSessionId', 'RtlGetCurrentTransaction', 'RtlGetCurrentUmsThread', 'RtlGetDaclSecurityDescriptor', 'RtlGetDeviceFamilyInfoEnum', 'RtlGetElementGenericTable', 'RtlGetElementGenericTableAvl', 'RtlGetEnabledExtendedFeatures', 'RtlGetExePath', 'RtlGetExtendedContextLength', 'RtlGetExtendedContextLength2', 'RtlGetExtendedFeaturesMask', 'RtlGetFileMUIPath', 'RtlGetFrame', 'RtlGetFullPathName_U', 'RtlGetFullPathName_UEx', 'RtlGetFullPathName_UstrEx', 'RtlGetFunctionTableListHead', 'RtlGetGroupSecurityDescriptor', 'RtlGetIntegerAtom', 'RtlGetInterruptTimePrecise', 'RtlGetLastNtStatus', 'RtlGetLastWin32Error', 'RtlGetLengthWithoutLastFullDosOrNtPathElement', 'RtlGetLengthWithoutTrailingPathSeperators', 'RtlGetLocaleFileMappingAddress', 'RtlGetLongestNtPathLength', 'RtlGetMultiTimePrecise', 'RtlGetNativeSystemInformation', 'RtlGetNextEntryHashTable', 'RtlGetNextUmsListItem', 'RtlGetNonVolatileToken', 'RtlGetNtGlobalFlags', 'RtlGetNtProductType', 'RtlGetNtSystemRoot', 'RtlGetNtVersionNumbers', 'RtlGetOwnerSecurityDescriptor', 'RtlGetParentLocaleName', 'RtlGetPersistedStateLocation', 'RtlGetProcessHeaps', 'RtlGetProcessPreferredUILanguages', 'RtlGetProductInfo', 'RtlGetSaclSecurityDescriptor', 'RtlGetSearchPath', 'RtlGetSecurityDescriptorRMControl', 'RtlGetSessionProperties', 'RtlGetSetBootStatusData', 'RtlGetSuiteMask', 'RtlGetSystemBootStatus', 'RtlGetSystemBootStatusEx', 'RtlGetSystemPreferredUILanguages', 'RtlGetSystemTimePrecise', 'RtlGetThreadErrorMode', 'RtlGetThreadLangIdByIndex', 'RtlGetThreadPreferredUILanguages', 'RtlGetThreadWorkOnBehalfTicket', 'RtlGetTokenNamedObjectPath', 'RtlGetUILanguageInfo', 'RtlGetUmsCompletionListEvent', 'RtlGetUnloadEventTrace', 'RtlGetUnloadEventTraceEx', 'RtlGetUserInfoHeap', 'RtlGetUserPreferredUILanguages', 'RtlGetVersion', 'RtlGrowFunctionTable', 'RtlGuardCheckLongJumpTarget', 'RtlHashUnicodeString', 'RtlHeapTrkInitialize', 'RtlIdentifierAuthoritySid', 'RtlIdnToAscii', 'RtlIdnToNameprepUnicode', 'RtlIdnToUnicode', 'RtlImageDirectoryEntryToData', 'RtlImageNtHeader', 'RtlImageNtHeaderEx', 'RtlImageRvaToSection', 'RtlImageRvaToVa', 'RtlImpersonateSelf', 'RtlImpersonateSelfEx', 'RtlIncrementCorrelationVector', 'RtlInitAnsiString', 'RtlInitAnsiStringEx', 'RtlInitBarrier', 'RtlInitCodePageTable', 'RtlInitEnumerationHashTable', 'RtlInitMemoryStream', 'RtlInitNlsTables', 'RtlInitOutOfProcessMemoryStream', 'RtlInitString', 'RtlInitStringEx', 'RtlInitStrongEnumerationHashTable', 'RtlInitUnicodeString', 'RtlInitUnicodeStringEx', 'RtlInitWeakEnumerationHashTable', 'RtlInitializeAtomPackage', 'RtlInitializeBitMap', 'RtlInitializeBitMapEx', 'RtlInitializeConditionVariable', 'RtlInitializeContext', 'RtlInitializeCorrelationVector', 'RtlInitializeCriticalSection', 'RtlInitializeCriticalSectionAndSpinCount', 'RtlInitializeCriticalSectionEx', 'RtlInitializeExtendedContext', 'RtlInitializeExtendedContext2', 'RtlInitializeGenericTable', 'RtlInitializeGenericTableAvl', 'RtlInitializeHandleTable', 'RtlInitializeNtUserPfn', 'RtlInitializeRXact', 'RtlInitializeResource', 'RtlInitializeSListHead', 'RtlInitializeSRWLock', 'RtlInitializeSid', 'RtlInitializeSidEx', 'RtlInsertElementGenericTable', 'RtlInsertElementGenericTableAvl', 'RtlInsertElementGenericTableFull', 'RtlInsertElementGenericTableFullAvl', 'RtlInsertEntryHashTable', 'RtlInstallFunctionTableCallback', 'RtlInt64ToUnicodeString', 'RtlIntegerToChar', 'RtlIntegerToUnicodeString', 'RtlInterlockedClearBitRun', 'RtlInterlockedFlushSList', 'RtlInterlockedPopEntrySList', 'RtlInterlockedPushEntrySList', 'RtlInterlockedPushListSList', 'RtlInterlockedPushListSListEx', 'RtlInterlockedSetBitRun', 'RtlIoDecodeMemIoResource', 'RtlIoEncodeMemIoResource', 'RtlIpv4AddressToStringA', 'RtlIpv4AddressToStringExA', 'RtlIpv4AddressToStringExW', 'RtlIpv4AddressToStringW', 'RtlIpv4StringToAddressA', 'RtlIpv4StringToAddressExA', 'RtlIpv4StringToAddressExW', 'RtlIpv4StringToAddressW', 'RtlIpv6AddressToStringA', 'RtlIpv6AddressToStringExA', 'RtlIpv6AddressToStringExW', 'RtlIpv6AddressToStringW', 'RtlIpv6StringToAddressA', 'RtlIpv6StringToAddressExA', 'RtlIpv6StringToAddressExW', 'RtlIpv6StringToAddressW', 'RtlIsActivationContextActive', 'RtlIsCapabilitySid', 'RtlIsCloudFilesPlaceholder', 'RtlIsCriticalSectionLocked', 'RtlIsCriticalSectionLockedByThread', 'RtlIsCurrentProcess', 'RtlIsCurrentThread', 'RtlIsCurrentThreadAttachExempt', 'RtlIsDosDeviceName_U', 'RtlIsElevatedRid', 'RtlIsGenericTableEmpty', 'RtlIsGenericTableEmptyAvl', 'RtlIsMultiSessionSku', 'RtlIsMultiUsersInSessionSku', 'RtlIsNameInExpression', 'RtlIsNameInUnUpcasedExpression', 'RtlIsNameLegalDOS8Dot3', 'RtlIsNonEmptyDirectoryReparsePointAllowed', 'RtlIsNormalizedString', 'RtlIsPackageSid', 'RtlIsParentOfChildAppContainer', 'RtlIsPartialPlaceholder', 'RtlIsPartialPlaceholderFileHandle', 'RtlIsPartialPlaceholderFileInfo', 'RtlIsProcessorFeaturePresent', 'RtlIsStateSeparationEnabled', 'RtlIsTextUnicode', 'RtlIsThreadWithinLoaderCallout', 'RtlIsUntrustedObject', 'RtlIsValidHandle', 'RtlIsValidIndexHandle', 'RtlIsValidLocaleName', 'RtlIsValidProcessTrustLabelSid', 'RtlKnownExceptionFilter', 'RtlLCIDToCultureName', 'RtlLargeIntegerToChar', 'RtlLcidToLocaleName', 'RtlLeaveCriticalSection', 'RtlLengthRequiredSid', 'RtlLengthSecurityDescriptor', 'RtlLengthSid', 'RtlLengthSidAsUnicodeString', 'RtlLoadString', 'RtlLocalTimeToSystemTime', 'RtlLocaleNameToLcid', 'RtlLocateExtendedFeature', 'RtlLocateExtendedFeature2', 'RtlLocateLegacyContext', 'RtlLockBootStatusData', 'RtlLockCurrentThread', 'RtlLockHeap', 'RtlLockMemoryBlockLookaside', 'RtlLockMemoryStreamRegion', 'RtlLockMemoryZone', 'RtlLockModuleSection', 'RtlLogStackBackTrace', 'RtlLookupAtomInAtomTable', 'RtlLookupElementGenericTable', 'RtlLookupElementGenericTableAvl', 'RtlLookupElementGenericTableFull', 'RtlLookupElementGenericTableFullAvl', 'RtlLookupEntryHashTable', 'RtlLookupFirstMatchingElementGenericTableAvl', 'RtlLookupFunctionEntry', 'RtlLookupFunctionTable', 'RtlMakeSelfRelativeSD', 'RtlMapGenericMask', 'RtlMapSecurityErrorToNtStatus', 'RtlMoveMemory', 'RtlMultiAppendUnicodeStringBuffer', 'RtlMultiByteToUnicodeN', 'RtlMultiByteToUnicodeSize', 'RtlMultipleAllocateHeap', 'RtlMultipleFreeHeap', 'RtlNewInstanceSecurityObject', 'RtlNewSecurityGrantedAccess', 'RtlNewSecurityObject', 'RtlNewSecurityObjectEx', 'RtlNewSecurityObjectWithMultipleInheritance', 'RtlNormalizeProcessParams', 'RtlNormalizeString', 'RtlNtPathNameToDosPathName', 'RtlNtStatusToDosError', 'RtlNtStatusToDosErrorNoTeb', 'RtlNtdllName', 'RtlNumberGenericTableElements', 'RtlNumberGenericTableElementsAvl', 'RtlNumberOfClearBits', 'RtlNumberOfClearBitsInRange', 'RtlNumberOfSetBits', 'RtlNumberOfSetBitsInRange', 'RtlNumberOfSetBitsUlongPtr', 'RtlOemStringToUnicodeSize', 'RtlOemStringToUnicodeString', 'RtlOemToUnicodeN', 'RtlOpenCurrentUser', 'RtlOsDeploymentState', 'RtlOwnerAcesPresent', 'RtlPcToFileHeader', 'RtlPinAtomInAtomTable', 'RtlPopFrame', 'RtlPrefixString', 'RtlPrefixUnicodeString', 'RtlPrepareForProcessCloning', 'RtlProcessFlsData', 'RtlProtectHeap', 'RtlPublishWnfStateData', 'RtlPushFrame', 'RtlQueryActivationContextApplicationSettings', 'RtlQueryAtomInAtomTable', 'RtlQueryCriticalSectionOwner', 'RtlQueryDepthSList', 'RtlQueryDynamicTimeZoneInformation', 'RtlQueryElevationFlags', 'RtlQueryEnvironmentVariable', 'RtlQueryEnvironmentVariable_U', 'RtlQueryHeapInformation', 'RtlQueryImageMitigationPolicy', 'RtlQueryInformationAcl', 'RtlQueryInformationActivationContext', 'RtlQueryInformationActiveActivationContext', 'RtlQueryInterfaceMemoryStream', 'RtlQueryModuleInformation', 'RtlQueryPackageClaims', 'RtlQueryPackageIdentity', 'RtlQueryPackageIdentityEx', 'RtlQueryPerformanceCounter', 'RtlQueryPerformanceFrequency', 'RtlQueryProcessBackTraceInformation', 'RtlQueryProcessDebugInformation', 'RtlQueryProcessHeapInformation', 'RtlQueryProcessLockInformation', 'RtlQueryProcessPlaceholderCompatibilityMode', 'RtlQueryProtectedPolicy', 'RtlQueryRegistryValueWithFallback', 'RtlQueryRegistryValues', 'RtlQueryRegistryValuesEx', 'RtlQueryResourcePolicy', 'RtlQuerySecurityObject', 'RtlQueryTagHeap', 'RtlQueryThreadPlaceholderCompatibilityMode', 'RtlQueryThreadProfiling', 'RtlQueryTimeZoneInformation', 'RtlQueryTokenHostIdAsUlong64', 'RtlQueryUmsThreadInformation', 'RtlQueryUnbiasedInterruptTime', 'RtlQueryValidationRunlevel', 'RtlQueryWnfMetaNotification', 'RtlQueryWnfStateData', 'RtlQueryWnfStateDataWithExplicitScope', 'RtlQueueApcWow64Thread', 'RtlQueueWorkItem', 'RtlRaiseCustomSystemEventTrigger', 'RtlRaiseException', 'RtlRaiseStatus', 'RtlRandom', 'RtlRandomEx', 'RtlRbInsertNodeEx', 'RtlRbRemoveNode', 'RtlReAllocateHeap', 'RtlReadMemoryStream', 'RtlReadOutOfProcessMemoryStream', 'RtlReadThreadProfilingData', 'RtlRealPredecessor', 'RtlRealSuccessor', 'RtlRegisterForWnfMetaNotification', 'RtlRegisterSecureMemoryCacheCallback', 'RtlRegisterThreadWithCsrss', 'RtlRegisterWait', 'RtlReleaseActivationContext', 'RtlReleaseMemoryStream', 'RtlReleasePath', 'RtlReleasePebLock', 'RtlReleasePrivilege', 'RtlReleaseRelativeName', 'RtlReleaseResource', 'RtlReleaseSRWLockExclusive', 'RtlReleaseSRWLockShared', 'RtlRemoteCall', 'RtlRemoveEntryHashTable', 'RtlRemovePrivileges', 'RtlRemoveVectoredContinueHandler', 'RtlRemoveVectoredExceptionHandler', 'RtlReplaceSidInSd', 'RtlReplaceSystemDirectoryInPath', 'RtlReportException', 'RtlReportExceptionEx', 'RtlReportSilentProcessExit', 'RtlReportSqmEscalation', 'RtlResetMemoryBlockLookaside', 'RtlResetMemoryZone', 'RtlResetNtUserPfn', 'RtlResetRtlTranslations', 'RtlRestoreBootStatusDefaults', 'RtlRestoreContext', 'RtlRestoreLastWin32Error', 'RtlRestoreSystemBootStatusDefaults', 'RtlRetrieveNtUserPfn', 'RtlRevertMemoryStream', 'RtlRunDecodeUnicodeString', 'RtlRunEncodeUnicodeString', 'RtlRunOnceBeginInitialize', 'RtlRunOnceComplete', 'RtlRunOnceExecuteOnce', 'RtlRunOnceInitialize', 'RtlSecondsSince1970ToTime', 'RtlSecondsSince1980ToTime', 'RtlSeekMemoryStream', 'RtlSelfRelativeToAbsoluteSD', 'RtlSelfRelativeToAbsoluteSD2', 'RtlSendMsgToSm', 'RtlSetAllBits', 'RtlSetAttributesSecurityDescriptor', 'RtlSetBit', 'RtlSetBits', 'RtlSetControlSecurityDescriptor', 'RtlSetCriticalSectionSpinCount', 'RtlSetCurrentDirectory_U', 'RtlSetCurrentEnvironment', 'RtlSetCurrentTransaction', 'RtlSetDaclSecurityDescriptor', 'RtlSetDynamicTimeZoneInformation', 'RtlSetEnvironmentStrings', 'RtlSetEnvironmentVar', 'RtlSetEnvironmentVariable', 'RtlSetExtendedFeaturesMask', 'RtlSetGroupSecurityDescriptor', 'RtlSetHeapInformation', 'RtlSetImageMitigationPolicy', 'RtlSetInformationAcl', 'RtlSetIoCompletionCallback', 'RtlSetLastWin32Error', 'RtlSetLastWin32ErrorAndNtStatusFromNtStatus', 'RtlSetMemoryStreamSize', 'RtlSetOwnerSecurityDescriptor', 'RtlSetPortableOperatingSystem', 'RtlSetProcessDebugInformation', 'RtlSetProcessIsCritical', 'RtlSetProcessPlaceholderCompatibilityMode', 'RtlSetProcessPreferredUILanguages', 'RtlSetProtectedPolicy', 'RtlSetProxiedProcessId', 'RtlSetSaclSecurityDescriptor', 'RtlSetSearchPathMode', 'RtlSetSecurityDescriptorRMControl', 'RtlSetSecurityObject', 'RtlSetSecurityObjectEx', 'RtlSetSystemBootStatus', 'RtlSetSystemBootStatusEx', 'RtlSetThreadErrorMode', 'RtlSetThreadIsCritical', 'RtlSetThreadPlaceholderCompatibilityMode', 'RtlSetThreadPoolStartFunc', 'RtlSetThreadPreferredUILanguages', 'RtlSetThreadSubProcessTag', 'RtlSetThreadWorkOnBehalfTicket', 'RtlSetTimeZoneInformation', 'RtlSetTimer', 'RtlSetUmsThreadInformation', 'RtlSetUnhandledExceptionFilter', 'RtlSetUserFlagsHeap', 'RtlSetUserValueHeap', 'RtlSidDominates', 'RtlSidDominatesForTrust', 'RtlSidEqualLevel', 'RtlSidHashInitialize', 'RtlSidHashLookup', 'RtlSidIsHigherLevel', 'RtlSizeHeap', 'RtlSleepConditionVariableCS', 'RtlSleepConditionVariableSRW', 'RtlSplay', 'RtlStartRXact', 'RtlStatMemoryStream', 'RtlStringFromGUID', 'RtlStringFromGUIDEx', 'RtlStronglyEnumerateEntryHashTable', 'RtlSubAuthorityCountSid', 'RtlSubAuthoritySid', 'RtlSubscribeWnfStateChangeNotification', 'RtlSubtreePredecessor', 'RtlSubtreeSuccessor', 'RtlSwitchedVVI', 'RtlSystemTimeToLocalTime', 'RtlTestAndPublishWnfStateData', 'RtlTestBit', 'RtlTestBitEx', 'RtlTestProtectedAccess', 'RtlTimeFieldsToTime', 'RtlTimeToElapsedTimeFields', 'RtlTimeToSecondsSince1970', 'RtlTimeToSecondsSince1980', 'RtlTimeToTimeFields', 'RtlTraceDatabaseAdd', 'RtlTraceDatabaseCreate', 'RtlTraceDatabaseDestroy', 'RtlTraceDatabaseEnumerate', 'RtlTraceDatabaseFind', 'RtlTraceDatabaseLock', 'RtlTraceDatabaseUnlock', 'RtlTraceDatabaseValidate', 'RtlTryAcquirePebLock', 'RtlTryAcquireSRWLockExclusive', 'RtlTryAcquireSRWLockShared', 'RtlTryConvertSRWLockSharedToExclusiveOrRelease', 'RtlTryEnterCriticalSection', 'RtlUTF8ToUnicodeN', 'RtlUmsThreadYield', 'RtlUnhandledExceptionFilter', 'RtlUnhandledExceptionFilter2', 'RtlUnicodeStringToAnsiSize', 'RtlUnicodeStringToAnsiString', 'RtlUnicodeStringToCountedOemString', 'RtlUnicodeStringToInteger', 'RtlUnicodeStringToOemSize', 'RtlUnicodeStringToOemString', 'RtlUnicodeToCustomCPN', 'RtlUnicodeToMultiByteN', 'RtlUnicodeToMultiByteSize', 'RtlUnicodeToOemN', 'RtlUnicodeToUTF8N', 'RtlUniform', 'RtlUnlockBootStatusData', 'RtlUnlockCurrentThread', 'RtlUnlockHeap', 'RtlUnlockMemoryBlockLookaside', 'RtlUnlockMemoryStreamRegion', 'RtlUnlockMemoryZone', 'RtlUnlockModuleSection', 'RtlUnsubscribeWnfNotificationWaitForCompletion', 'RtlUnsubscribeWnfNotificationWithCompletionCallback', 'RtlUnsubscribeWnfStateChangeNotification', 'RtlUnwind', 'RtlUnwindEx', 'RtlUpcaseUnicodeChar', 'RtlUpcaseUnicodeString', 'RtlUpcaseUnicodeStringToAnsiString', 'RtlUpcaseUnicodeStringToCountedOemString', 'RtlUpcaseUnicodeStringToOemString', 'RtlUpcaseUnicodeToCustomCPN', 'RtlUpcaseUnicodeToMultiByteN', 'RtlUpcaseUnicodeToOemN', 'RtlUpdateClonedCriticalSection', 'RtlUpdateClonedSRWLock', 'RtlUpdateTimer', 'RtlUpperChar', 'RtlUpperString', 'RtlUserFiberStart', 'RtlUserThreadStart', 'RtlValidAcl', 'RtlValidProcessProtection', 'RtlValidRelativeSecurityDescriptor', 'RtlValidSecurityDescriptor', 'RtlValidSid', 'RtlValidateCorrelationVector', 'RtlValidateHeap', 'RtlValidateProcessHeaps', 'RtlValidateUnicodeString', 'RtlVerifyVersionInfo', 'RtlVirtualUnwind', 'RtlWaitForWnfMetaNotification', 'RtlWaitOnAddress', 'RtlWakeAddressAll', 'RtlWakeAddressAllNoFence', 'RtlWakeAddressSingle', 'RtlWakeAddressSingleNoFence', 'RtlWakeAllConditionVariable', 'RtlWakeConditionVariable', 'RtlWalkFrameChain', 'RtlWalkHeap', 'RtlWeaklyEnumerateEntryHashTable', 'RtlWerpReportException', 'RtlWnfCompareChangeStamp', 'RtlWnfDllUnloadCallback', 'RtlWow64CallFunction64', 'RtlWow64EnableFsRedirection', 'RtlWow64EnableFsRedirectionEx', 'RtlWow64GetCpuAreaInfo', 'RtlWow64GetCurrentCpuArea', 'RtlWow64GetCurrentMachine', 'RtlWow64GetEquivalentMachineCHPE', 'RtlWow64GetProcessMachines', 'RtlWow64GetSharedInfoProcess', 'RtlWow64GetThreadContext', 'RtlWow64GetThreadSelectorEntry', 'RtlWow64IsWowGuestMachineSupported', 'RtlWow64LogMessageInEventLogger', 'RtlWow64PopAllCrossProcessWork', 'RtlWow64PopCrossProcessWork', 'RtlWow64PushCrossProcessWork', 'RtlWow64SetThreadContext', 'RtlWow64SuspendThread', 'RtlWriteMemoryStream', 'RtlWriteNonVolatileMemory', 'RtlWriteRegistryValue', 'RtlZeroHeap', 'RtlZeroMemory', 'RtlZombifyActivationContext', 'RtlpApplyLengthFunction', 'RtlpCheckDynamicTimeZoneInformation', 'RtlpCleanupRegistryKeys', 'RtlpConvertAbsoluteToRelativeSecurityAttribute', 'RtlpConvertCultureNamesToLCIDs', 'RtlpConvertLCIDsToCultureNames', 'RtlpConvertRelativeToAbsoluteSecurityAttribute', 'RtlpCreateProcessRegistryInfo', 'RtlpEnsureBufferSize', 'RtlpExecuteUmsThread', 'RtlpFreezeTimeBias', 'RtlpGetDeviceFamilyInfoEnum', 'RtlpGetLCIDFromLangInfoNode', 'RtlpGetNameFromLangInfoNode', 'RtlpGetSystemDefaultUILanguage', 'RtlpGetUserOrMachineUILanguage4NLS', 'RtlpInitializeLangRegistryInfo', 'RtlpIsQualifiedLanguage', 'RtlpLoadMachineUIByPolicy', 'RtlpLoadUserUIByPolicy', 'RtlpMergeSecurityAttributeInformation', 'RtlpMuiFreeLangRegistryInfo', 'RtlpMuiRegCreateRegistryInfo', 'RtlpMuiRegFreeRegistryInfo', 'RtlpMuiRegLoadRegistryInfo', 'RtlpNotOwnerCriticalSection', 'RtlpNtCreateKey', 'RtlpNtEnumerateSubKey', 'RtlpNtMakeTemporaryKey', 'RtlpNtOpenKey', 'RtlpNtQueryValueKey', 'RtlpNtSetValueKey', 'RtlpQueryDefaultUILanguage', 'RtlpQueryProcessDebugInformationFromWow64', 'RtlpQueryProcessDebugInformationRemote', 'RtlpRefreshCachedUILanguage', 'RtlpSetInstallLanguage', 'RtlpSetPreferredUILanguages', 'RtlpSetUserPreferredUILanguages', 'RtlpTimeFieldsToTime', 'RtlpTimeToTimeFields', 'RtlpUmsExecuteYieldThreadEnd', 'RtlpUmsThreadYield', 'RtlpUnWaitCriticalSection', 'RtlpVerifyAndCommitUILanguageSettings', 'RtlpWaitForCriticalSection', 'RtlpWow64CtxFromAmd64', 'RtlpWow64GetContextOnAmd64', 'RtlpWow64SetContextOnAmd64', 'RtlxAnsiStringToUnicodeSize', 'RtlxOemStringToUnicodeSize', 'RtlxUnicodeStringToAnsiSize', 'RtlxUnicodeStringToOemSize', 'SbExecuteProcedure', 'SbSelectProcedure', 'ShipAssert', 'ShipAssertGetBufferInfo', 'ShipAssertMsgA', 'ShipAssertMsgW', 'TpAllocAlpcCompletion', 'TpAllocAlpcCompletionEx', 'TpAllocCleanupGroup', 'TpAllocIoCompletion', 'TpAllocJobNotification', 'TpAllocPool', 'TpAllocTimer', 'TpAllocWait', 'TpAllocWork', 'TpAlpcRegisterCompletionList', 'TpAlpcUnregisterCompletionList', 'TpCallbackDetectedUnrecoverableError', 'TpCallbackIndependent', 'TpCallbackLeaveCriticalSectionOnCompletion', 'TpCallbackMayRunLong', 'TpCallbackReleaseMutexOnCompletion', 'TpCallbackReleaseSemaphoreOnCompletion', 'TpCallbackSendAlpcMessageOnCompletion', 'TpCallbackSendPendingAlpcMessage', 'TpCallbackSetEventOnCompletion', 'TpCallbackUnloadDllOnCompletion', 'TpCancelAsyncIoOperation', 'TpCaptureCaller', 'TpCheckTerminateWorker', 'TpDbgDumpHeapUsage', 'TpDbgSetLogRoutine', 'TpDisablePoolCallbackChecks', 'TpDisassociateCallback', 'TpIsTimerSet', 'TpPostWork', 'TpQueryPoolStackInformation', 'TpReleaseAlpcCompletion', 'TpReleaseCleanupGroup', 'TpReleaseCleanupGroupMembers', 'TpReleaseIoCompletion', 'TpReleaseJobNotification', 'TpReleasePool', 'TpReleaseTimer', 'TpReleaseWait', 'TpReleaseWork', 'TpSetDefaultPoolMaxThreads', 'TpSetDefaultPoolStackInformation', 'TpSetPoolMaxThreads', 'TpSetPoolMaxThreadsSoftLimit', 'TpSetPoolMinThreads', 'TpSetPoolStackInformation', 'TpSetPoolThreadBasePriority', 'TpSetPoolWorkerThreadIdleTimeout', 'TpSetTimer', 'TpSetTimerEx', 'TpSetWait', 'TpSetWaitEx', 'TpSimpleTryPost', 'TpStartAsyncIoOperation', 'TpTimerOutstandingCallbackCount', 'TpTrimPools', 'TpWaitForAlpcCompletion', 'TpWaitForIoCompletion', 'TpWaitForJobNotification', 'TpWaitForTimer', 'TpWaitForWait', 'TpWaitForWork', 'VerSetConditionMask', 'WerReportExceptionWorker', 'WerReportSQMEvent', 'WinSqmAddToAverageDWORD', 'WinSqmAddToStream', 'WinSqmAddToStreamEx', 'WinSqmCheckEscalationAddToStreamEx', 'WinSqmCheckEscalationSetDWORD', 'WinSqmCheckEscalationSetDWORD64', 'WinSqmCheckEscalationSetString', 'WinSqmCommonDatapointDelete', 'WinSqmCommonDatapointSetDWORD', 'WinSqmCommonDatapointSetDWORD64', 'WinSqmCommonDatapointSetStreamEx', 'WinSqmCommonDatapointSetString', 'WinSqmEndSession', 'WinSqmEventEnabled', 'WinSqmEventWrite', 'WinSqmGetEscalationRuleStatus', 'WinSqmGetInstrumentationProperty', 'WinSqmIncrementDWORD', 'WinSqmIsOptedIn', 'WinSqmIsOptedInEx', 'WinSqmIsSessionDisabled', 'WinSqmSetDWORD', 'WinSqmSetDWORD64', 'WinSqmSetEscalationInfo', 'WinSqmSetIfMaxDWORD', 'WinSqmSetIfMinDWORD', 'WinSqmSetString', 'WinSqmStartSession', 'WinSqmStartSessionForPartner', 'WinSqmStartSqmOptinListener', 'ZwAcceptConnectPort', 'ZwAccessCheck', 'ZwAccessCheckAndAuditAlarm', 'ZwAccessCheckByType', 'ZwAccessCheckByTypeAndAuditAlarm', 'ZwAccessCheckByTypeResultList', 'ZwAccessCheckByTypeResultListAndAuditAlarm', 'ZwAccessCheckByTypeResultListAndAuditAlarmByHandle', 'ZwAcquireProcessActivityReference', 'ZwAddAtom', 'ZwAddAtomEx', 'ZwAddBootEntry', 'ZwAddDriverEntry', 'ZwAdjustGroupsToken', 'ZwAdjustPrivilegesToken', 'ZwAdjustTokenClaimsAndDeviceGroups', 'ZwAlertResumeThread', 'ZwAlertThread', 'ZwAlertThreadByThreadId', 'ZwAllocateLocallyUniqueId', 'ZwAllocateReserveObject', 'ZwAllocateUserPhysicalPages', 'ZwAllocateUuids', 'ZwAllocateVirtualMemory', 'ZwAllocateVirtualMemoryEx', 'ZwAlpcAcceptConnectPort', 'ZwAlpcCancelMessage', 'ZwAlpcConnectPort', 'ZwAlpcConnectPortEx', 'ZwAlpcCreatePort', 'ZwAlpcCreatePortSection', 'ZwAlpcCreateResourceReserve', 'ZwAlpcCreateSectionView', 'ZwAlpcCreateSecurityContext', 'ZwAlpcDeletePortSection', 'ZwAlpcDeleteResourceReserve', 'ZwAlpcDeleteSectionView', 'ZwAlpcDeleteSecurityContext', 'ZwAlpcDisconnectPort', 'ZwAlpcImpersonateClientContainerOfPort', 'ZwAlpcImpersonateClientOfPort', 'ZwAlpcOpenSenderProcess', 'ZwAlpcOpenSenderThread', 'ZwAlpcQueryInformation', 'ZwAlpcQueryInformationMessage', 'ZwAlpcRevokeSecurityContext', 'ZwAlpcSendWaitReceivePort', 'ZwAlpcSetInformation', 'ZwApphelpCacheControl', 'ZwAreMappedFilesTheSame', 'ZwAssignProcessToJobObject', 'ZwAssociateWaitCompletionPacket', 'ZwCallEnclave', 'ZwCallbackReturn', 'ZwCancelIoFile', 'ZwCancelIoFileEx', 'ZwCancelSynchronousIoFile', 'ZwCancelTimer', 'ZwCancelTimer2', 'ZwCancelWaitCompletionPacket', 'ZwClearEvent', 'ZwClose', 'ZwCloseObjectAuditAlarm', 'ZwCommitComplete', 'ZwCommitEnlistment', 'ZwCommitRegistryTransaction', 'ZwCommitTransaction', 'ZwCompactKeys', 'ZwCompareObjects', 'ZwCompareSigningLevels', 'ZwCompareTokens', 'ZwCompleteConnectPort', 'ZwCompressKey', 'ZwConnectPort', 'ZwContinue', 'ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter', 'ZwCreateDebugObject', 'ZwCreateDirectoryObject', 'ZwCreateDirectoryObjectEx', 'ZwCreateEnclave', 'ZwCreateEnlistment', 'ZwCreateEvent', 'ZwCreateEventPair', 'ZwCreateFile', 'ZwCreateIRTimer', 'ZwCreateIoCompletion', 'ZwCreateJobObject', 'ZwCreateJobSet', 'ZwCreateKey', 'ZwCreateKeyTransacted', 'ZwCreateKeyedEvent', 'ZwCreateLowBoxToken', 'ZwCreateMailslotFile', 'ZwCreateMutant', 'ZwCreateNamedPipeFile', 'ZwCreatePagingFile', 'ZwCreatePartition', 'ZwCreatePort', 'ZwCreatePrivateNamespace', 'ZwCreateProcess', 'ZwCreateProcessEx', 'ZwCreateProfile', 'ZwCreateProfileEx', 'ZwCreateRegistryTransaction', 'ZwCreateResourceManager', 'ZwCreateSection', 'ZwCreateSectionEx', 'ZwCreateSemaphore', 'ZwCreateSymbolicLinkObject', 'ZwCreateThread', 'ZwCreateThreadEx', 'ZwCreateTimer', 'ZwCreateTimer2', 'ZwCreateToken', 'ZwCreateTokenEx', 'ZwCreateTransaction', 'ZwCreateTransactionManager', 'ZwCreateUserProcess', 'ZwCreateWaitCompletionPacket', 'ZwCreateWaitablePort', 'ZwCreateWnfStateName', 'ZwCreateWorkerFactory', 'ZwDebugActiveProcess', 'ZwDebugContinue', 'ZwDelayExecution', 'ZwDeleteAtom', 'ZwDeleteBootEntry', 'ZwDeleteDriverEntry', 'ZwDeleteFile', 'ZwDeleteKey', 'ZwDeleteObjectAuditAlarm', 'ZwDeletePrivateNamespace', 'ZwDeleteValueKey', 'ZwDeleteWnfStateData', 'ZwDeleteWnfStateName', 'ZwDeviceIoControlFile', 'ZwDisableLastKnownGood', 'ZwDisplayString', 'ZwDrawText', 'ZwDuplicateObject', 'ZwDuplicateToken', 'ZwEnableLastKnownGood', 'ZwEnumerateBootEntries', 'ZwEnumerateDriverEntries', 'ZwEnumerateKey', 'ZwEnumerateSystemEnvironmentValuesEx', 'ZwEnumerateTransactionObject', 'ZwEnumerateValueKey', 'ZwExtendSection', 'ZwFilterBootOption', 'ZwFilterToken', 'ZwFilterTokenEx', 'ZwFindAtom', 'ZwFlushBuffersFile', 'ZwFlushBuffersFileEx', 'ZwFlushInstallUILanguage', 'ZwFlushInstructionCache', 'ZwFlushKey', 'ZwFlushProcessWriteBuffers', 'ZwFlushVirtualMemory', 'ZwFlushWriteBuffer', 'ZwFreeUserPhysicalPages', 'ZwFreeVirtualMemory', 'ZwFreezeRegistry', 'ZwFreezeTransactions', 'ZwFsControlFile', 'ZwGetCachedSigningLevel', 'ZwGetCompleteWnfStateSubscription', 'ZwGetContextThread', 'ZwGetCurrentProcessorNumber', 'ZwGetCurrentProcessorNumberEx', 'ZwGetDevicePowerState', 'ZwGetMUIRegistryInfo', 'ZwGetNextProcess', 'ZwGetNextThread', 'ZwGetNlsSectionPtr', 'ZwGetNotificationResourceManager', 'ZwGetWriteWatch', 'ZwImpersonateAnonymousToken', 'ZwImpersonateClientOfPort', 'ZwImpersonateThread', 'ZwInitializeEnclave', 'ZwInitializeNlsFiles', 'ZwInitializeRegistry', 'ZwInitiatePowerAction', 'ZwIsProcessInJob', 'ZwIsSystemResumeAutomatic', 'ZwIsUILanguageComitted', 'ZwListenPort', 'ZwLoadDriver', 'ZwLoadEnclaveData', 'ZwLoadKey', 'ZwLoadKey2', 'ZwLoadKeyEx', 'ZwLockFile', 'ZwLockProductActivationKeys', 'ZwLockRegistryKey', 'ZwLockVirtualMemory', 'ZwMakePermanentObject', 'ZwMakeTemporaryObject', 'ZwManageHotPatch', 'ZwManagePartition', 'ZwMapCMFModule', 'ZwMapUserPhysicalPages', 'ZwMapUserPhysicalPagesScatter', 'ZwMapViewOfSection', 'ZwMapViewOfSectionEx', 'ZwModifyBootEntry', 'ZwModifyDriverEntry', 'ZwNotifyChangeDirectoryFile', 'ZwNotifyChangeDirectoryFileEx', 'ZwNotifyChangeKey', 'ZwNotifyChangeMultipleKeys', 'ZwNotifyChangeSession', 'ZwOpenDirectoryObject', 'ZwOpenEnlistment', 'ZwOpenEvent', 'ZwOpenEventPair', 'ZwOpenFile', 'ZwOpenIoCompletion', 'ZwOpenJobObject', 'ZwOpenKey', 'ZwOpenKeyEx', 'ZwOpenKeyTransacted', 'ZwOpenKeyTransactedEx', 'ZwOpenKeyedEvent', 'ZwOpenMutant', 'ZwOpenObjectAuditAlarm', 'ZwOpenPartition', 'ZwOpenPrivateNamespace', 'ZwOpenProcess', 'ZwOpenProcessToken', 'ZwOpenProcessTokenEx', 'ZwOpenRegistryTransaction', 'ZwOpenResourceManager', 'ZwOpenSection', 'ZwOpenSemaphore', 'ZwOpenSession', 'ZwOpenSymbolicLinkObject', 'ZwOpenThread', 'ZwOpenThreadToken', 'ZwOpenThreadTokenEx', 'ZwOpenTimer', 'ZwOpenTransaction', 'ZwOpenTransactionManager', 'ZwPlugPlayControl', 'ZwPowerInformation', 'ZwPrePrepareComplete', 'ZwPrePrepareEnlistment', 'ZwPrepareComplete', 'ZwPrepareEnlistment', 'ZwPrivilegeCheck', 'ZwPrivilegeObjectAuditAlarm', 'ZwPrivilegedServiceAuditAlarm', 'ZwPropagationComplete', 'ZwPropagationFailed', 'ZwProtectVirtualMemory', 'ZwPulseEvent', 'ZwQueryAttributesFile', 'ZwQueryAuxiliaryCounterFrequency', 'ZwQueryBootEntryOrder', 'ZwQueryBootOptions', 'ZwQueryDebugFilterState', 'ZwQueryDefaultLocale', 'ZwQueryDefaultUILanguage', 'ZwQueryDirectoryFile', 'ZwQueryDirectoryFileEx', 'ZwQueryDirectoryObject', 'ZwQueryDriverEntryOrder', 'ZwQueryEaFile', 'ZwQueryEvent', 'ZwQueryFullAttributesFile', 'ZwQueryInformationAtom', 'ZwQueryInformationByName', 'ZwQueryInformationEnlistment', 'ZwQueryInformationFile', 'ZwQueryInformationJobObject', 'ZwQueryInformationPort', 'ZwQueryInformationProcess', 'ZwQueryInformationResourceManager', 'ZwQueryInformationThread', 'ZwQueryInformationToken', 'ZwQueryInformationTransaction', 'ZwQueryInformationTransactionManager', 'ZwQueryInformationWorkerFactory', 'ZwQueryInstallUILanguage', 'ZwQueryIntervalProfile', 'ZwQueryIoCompletion', 'ZwQueryKey', 'ZwQueryLicenseValue', 'ZwQueryMultipleValueKey', 'ZwQueryMutant', 'ZwQueryObject', 'ZwQueryOpenSubKeys', 'ZwQueryOpenSubKeysEx', 'ZwQueryPerformanceCounter', 'ZwQueryPortInformationProcess', 'ZwQueryQuotaInformationFile', 'ZwQuerySection', 'ZwQuerySecurityAttributesToken', 'ZwQuerySecurityObject', 'ZwQuerySecurityPolicy', 'ZwQuerySemaphore', 'ZwQuerySymbolicLinkObject', 'ZwQuerySystemEnvironmentValue', 'ZwQuerySystemEnvironmentValueEx', 'ZwQuerySystemInformation', 'ZwQuerySystemInformationEx', 'ZwQuerySystemTime', 'ZwQueryTimer', 'ZwQueryTimerResolution', 'ZwQueryValueKey', 'ZwQueryVirtualMemory', 'ZwQueryVolumeInformationFile', 'ZwQueryWnfStateData', 'ZwQueryWnfStateNameInformation', 'ZwQueueApcThread', 'ZwQueueApcThreadEx', 'ZwRaiseException', 'ZwRaiseHardError', 'ZwReadFile', 'ZwReadFileScatter', 'ZwReadOnlyEnlistment', 'ZwReadRequestData', 'ZwReadVirtualMemory', 'ZwRecoverEnlistment', 'ZwRecoverResourceManager', 'ZwRecoverTransactionManager', 'ZwRegisterProtocolAddressInformation', 'ZwRegisterThreadTerminatePort', 'ZwReleaseKeyedEvent', 'ZwReleaseMutant', 'ZwReleaseSemaphore', 'ZwReleaseWorkerFactoryWorker', 'ZwRemoveIoCompletion', 'ZwRemoveIoCompletionEx', 'ZwRemoveProcessDebug', 'ZwRenameKey', 'ZwRenameTransactionManager', 'ZwReplaceKey', 'ZwReplacePartitionUnit', 'ZwReplyPort', 'ZwReplyWaitReceivePort', 'ZwReplyWaitReceivePortEx', 'ZwReplyWaitReplyPort', 'ZwRequestPort', 'ZwRequestWaitReplyPort', 'ZwResetEvent', 'ZwResetWriteWatch', 'ZwRestoreKey', 'ZwResumeProcess', 'ZwResumeThread', 'ZwRevertContainerImpersonation', 'ZwRollbackComplete', 'ZwRollbackEnlistment', 'ZwRollbackRegistryTransaction', 'ZwRollbackTransaction', 'ZwRollforwardTransactionManager', 'ZwSaveKey', 'ZwSaveKeyEx', 'ZwSaveMergedKeys', 'ZwSecureConnectPort', 'ZwSerializeBoot', 'ZwSetBootEntryOrder', 'ZwSetBootOptions', 'ZwSetCachedSigningLevel', 'ZwSetCachedSigningLevel2', 'ZwSetContextThread', 'ZwSetDebugFilterState', 'ZwSetDefaultHardErrorPort', 'ZwSetDefaultLocale', 'ZwSetDefaultUILanguage', 'ZwSetDriverEntryOrder', 'ZwSetEaFile', 'ZwSetEvent', 'ZwSetEventBoostPriority', 'ZwSetHighEventPair', 'ZwSetHighWaitLowEventPair', 'ZwSetIRTimer', 'ZwSetInformationDebugObject', 'ZwSetInformationEnlistment', 'ZwSetInformationFile', 'ZwSetInformationJobObject', 'ZwSetInformationKey', 'ZwSetInformationObject', 'ZwSetInformationProcess', 'ZwSetInformationResourceManager', 'ZwSetInformationSymbolicLink', 'ZwSetInformationThread', 'ZwSetInformationToken', 'ZwSetInformationTransaction', 'ZwSetInformationTransactionManager', 'ZwSetInformationVirtualMemory', 'ZwSetInformationWorkerFactory', 'ZwSetIntervalProfile', 'ZwSetIoCompletion', 'ZwSetIoCompletionEx', 'ZwSetLdtEntries', 'ZwSetLowEventPair', 'ZwSetLowWaitHighEventPair', 'ZwSetQuotaInformationFile', 'ZwSetSecurityObject', 'ZwSetSystemEnvironmentValue', 'ZwSetSystemEnvironmentValueEx', 'ZwSetSystemInformation', 'ZwSetSystemPowerState', 'ZwSetSystemTime', 'ZwSetThreadExecutionState', 'ZwSetTimer', 'ZwSetTimer2', 'ZwSetTimerEx', 'ZwSetTimerResolution', 'ZwSetUuidSeed', 'ZwSetValueKey', 'ZwSetVolumeInformationFile', 'ZwSetWnfProcessNotificationEvent', 'ZwShutdownSystem', 'ZwShutdownWorkerFactory', 'ZwSignalAndWaitForSingleObject', 'ZwSinglePhaseReject', 'ZwStartProfile', 'ZwStopProfile', 'ZwSubscribeWnfStateChange', 'ZwSuspendProcess', 'ZwSuspendThread', 'ZwSystemDebugControl', 'ZwTerminateEnclave', 'ZwTerminateJobObject', 'ZwTerminateProcess', 'ZwTerminateThread', 'ZwTestAlert', 'ZwThawRegistry', 'ZwThawTransactions', 'ZwTraceControl', 'ZwTraceEvent', 'ZwTranslateFilePath', 'ZwUmsThreadYield', 'ZwUnloadDriver', 'ZwUnloadKey', 'ZwUnloadKey2', 'ZwUnloadKeyEx', 'ZwUnlockFile', 'ZwUnlockVirtualMemory', 'ZwUnmapViewOfSection', 'ZwUnmapViewOfSectionEx', 'ZwUnsubscribeWnfStateChange', 'ZwUpdateWnfStateData', 'ZwVdmControl', 'ZwWaitForAlertByThreadId', 'ZwWaitForDebugEvent', 'ZwWaitForKeyedEvent', 'ZwWaitForMultipleObjects', 'ZwWaitForMultipleObjects32', 'ZwWaitForSingleObject', 'ZwWaitForWorkViaWorkerFactory', 'ZwWaitHighEventPair', 'ZwWaitLowEventPair', 'ZwWorkerFactoryWorkerReady', 'ZwWriteFile', 'ZwWriteFileGather', 'ZwWriteRequestData', 'ZwWriteVirtualMemory', 'ZwYieldExecution', '__C_specific_handler', '__chkstk', '__isascii', '__iscsym', '__iscsymf', '__misaligned_access', '__toascii', '_atoi64', '_errno', '_fltused', '_i64toa', '_i64toa_s', '_i64tow', '_i64tow_s', '_itoa', '_itoa_s', '_itow', '_itow_s', '_lfind', '_local_unwind', '_ltoa', '_ltoa_s', '_ltow', '_ltow_s', '_makepath_s', '_memccpy', '_memicmp', '_setjmp', '_setjmpex', '_snprintf', '_snprintf_s', '_snscanf_s', '_snwprintf', '_snwprintf_s', '_snwscanf_s', '_splitpath', '_splitpath_s', '_strcmpi', '_stricmp', '_strlwr', '_strlwr_s', '_strnicmp', '_strnset_s', '_strset_s', '_strupr', '_strupr_s', '_swprintf', '_ui64toa', '_ui64toa_s', '_ui64tow', '_ui64tow_s', '_ultoa', '_ultoa_s', '_ultow', '_ultow_s', '_vscprintf', '_vscwprintf', '_vsnprintf', '_vsnprintf_s', '_vsnwprintf', '_vsnwprintf_s', '_vswprintf', '_wcsicmp', '_wcslwr', '_wcslwr_s', '_wcsnicmp', '_wcsnset_s', '_wcsset_s', '_wcstoi64', '_wcstoui64', '_wcsupr', '_wcsupr_s', '_wmakepath_s', '_wsplitpath_s', '_wtoi', '_wtoi64', '_wtol', 'abs', 'atan', 'atan2', 'atoi', 'atol', 'bsearch', 'bsearch_s', 'ceil', 'cos', 'fabs', 'floor', 'isalnum', 'isalpha', 'iscntrl', 'isdigit', 'isgraph', 'islower', 'isprint', 'ispunct', 'isspace', 'isupper', 'iswalnum', 'iswalpha', 'iswascii', 'iswctype', 'iswdigit', 'iswgraph', 'iswlower', 'iswprint', 'iswspace', 'iswxdigit', 'isxdigit', 'labs', 'log', 'longjmp', 'mbstowcs', 'memchr', 'memcmp', 'memcpy', 'memcpy_s', 'memmove', 'memmove_s', 'memset', 'pow', 'qsort', 'qsort_s', 'sin', 'sprintf', 'sprintf_s', 'sqrt', 'sscanf', 'sscanf_s', 'strcat', 'strcat_s', 'strchr', 'strcmp', 'strcpy', 'strcpy_s', 'strcspn', 'strlen', 'strncat', 'strncat_s', 'strncmp', 'strncpy', 'strncpy_s', 'strnlen', 'strpbrk', 'strrchr', 'strspn', 'strstr', 'strtok_s', 'strtol', 'strtoul', 'swprintf', 'swprintf_s', 'swscanf_s', 'tan', 'tolower', 'toupper', 'towlower', 'towupper', 'vDbgPrintEx', 'vDbgPrintExWithPrefix', 'vsprintf', 'vsprintf_s', 'vswprintf_s', 'wcscat', 'wcscat_s', 'wcschr', 'wcscmp', 'wcscpy', 'wcscpy_s', 'wcscspn', 'wcslen', 'wcsncat', 'wcsncat_s', 'wcsncmp', 'wcsncpy', 'wcsncpy_s', 'wcsnlen', 'wcspbrk', 'wcsrchr', 'wcsspn', 'wcsstr', 'wcstok_s', 'wcstol', 'wcstombs', 'wcstoul', 'ActivateKeyboardLayout', 'AddClipboardFormatListener', 'AdjustWindowRect', 'AdjustWindowRectEx', 'AdjustWindowRectExForDpi', 'AlignRects', 'AllowForegroundActivation', 'AllowSetForegroundWindow', 'AnimateWindow', 'AnyPopup', 'AppendMenuA', 'AppendMenuW', 'AreDpiAwarenessContextsEqual', 'ArrangeIconicWindows', 'AttachThreadInput', 'BeginDeferWindowPos', 'BeginPaint', 'BlockInput', 'BringWindowToTop', 'BroadcastSystemMessage', 'BroadcastSystemMessageA', 'BroadcastSystemMessageExA', 'BroadcastSystemMessageExW', 'BroadcastSystemMessageW', 'BuildReasonArray', 'CalcMenuBar', 'CalculatePopupWindowPosition', 'CallMsgFilter', 'CallMsgFilterA', 'CallMsgFilterW', 'CallNextHookEx', 'CallWindowProcA', 'CallWindowProcW', 'CancelShutdown', 'CascadeChildWindows', 'CascadeWindows', 'ChangeClipboardChain', 'ChangeDisplaySettingsA', 'ChangeDisplaySettingsExA', 'ChangeDisplaySettingsExW', 'ChangeDisplaySettingsW', 'ChangeMenuA', 'ChangeMenuW', 'ChangeWindowMessageFilter', 'ChangeWindowMessageFilterEx', 'CharLowerA', 'CharLowerBuffA', 'CharLowerBuffW', 'CharLowerW', 'CharNextA', 'CharNextExA', 'CharNextW', 'CharPrevA', 'CharPrevExA', 'CharPrevW', 'CharToOemA', 'CharToOemBuffA', 'CharToOemBuffW', 'CharToOemW', 'CharUpperA', 'CharUpperBuffA', 'CharUpperBuffW', 'CharUpperW', 'CheckBannedOneCoreTransformApi', 'CheckDBCSEnabledExt', 'CheckDlgButton', 'CheckMenuItem', 'CheckMenuRadioItem', 'CheckProcessForClipboardAccess', 'CheckProcessSession', 'CheckRadioButton', 'CheckWindowThreadDesktop', 'ChildWindowFromPoint', 'ChildWindowFromPointEx', 'CliImmSetHotKey', 'ClientThreadSetup', 'ClientToScreen', 'ClipCursor', 'CloseClipboard', 'CloseDesktop', 'CloseGestureInfoHandle', 'CloseTouchInputHandle', 'CloseWindow', 'CloseWindowStation', 'ConsoleControl', 'ControlMagnification', 'CopyAcceleratorTableA', 'CopyAcceleratorTableW', 'CopyIcon', 'CopyImage', 'CopyRect', 'CountClipboardFormats', 'CreateAcceleratorTableA', 'CreateAcceleratorTableW', 'CreateCaret', 'CreateCursor', 'CreateDCompositionHwndTarget', 'CreateDesktopA', 'CreateDesktopExA', 'CreateDesktopExW', 'CreateDesktopW', 'CreateDialogIndirectParamA', 'CreateDialogIndirectParamAorW', 'CreateDialogIndirectParamW', 'CreateDialogParamA', 'CreateDialogParamW', 'CreateIcon', 'CreateIconFromResource', 'CreateIconFromResourceEx', 'CreateIconIndirect', 'CreateMDIWindowA', 'CreateMDIWindowW', 'CreateMenu', 'CreatePopupMenu', 'CreateSyntheticPointerDevice', 'CreateSystemThreads', 'CreateWindowExA', 'CreateWindowExW', 'CreateWindowInBand', 'CreateWindowInBandEx', 'CreateWindowIndirect', 'CreateWindowStationA', 'CreateWindowStationW', 'CsrBroadcastSystemMessageExW', 'CtxInitUser32', 'DdeAbandonTransaction', 'DdeAccessData', 'DdeAddData', 'DdeClientTransaction', 'DdeCmpStringHandles', 'DdeConnect', 'DdeConnectList', 'DdeCreateDataHandle', 'DdeCreateStringHandleA', 'DdeCreateStringHandleW', 'DdeDisconnect', 'DdeDisconnectList', 'DdeEnableCallback', 'DdeFreeDataHandle', 'DdeFreeStringHandle', 'DdeGetData', 'DdeGetLastError', 'DdeGetQualityOfService', 'DdeImpersonateClient', 'DdeInitializeA', 'DdeInitializeW', 'DdeKeepStringHandle', 'DdeNameService', 'DdePostAdvise', 'DdeQueryConvInfo', 'DdeQueryNextServer', 'DdeQueryStringA', 'DdeQueryStringW', 'DdeReconnect', 'DdeSetQualityOfService', 'DdeSetUserHandle', 'DdeUnaccessData', 'DdeUninitialize', 'DefDlgProcA', 'DefDlgProcW', 'DefFrameProcA', 'DefFrameProcW', 'DefMDIChildProcA', 'DefMDIChildProcW', 'DefRawInputProc', 'DefWindowProcA', 'DefWindowProcW', 'DeferWindowPos', 'DeferWindowPosAndBand', 'DelegateInput', 'DeleteMenu', 'DeregisterShellHookWindow', 'DestroyAcceleratorTable', 'DestroyCaret', 'DestroyCursor', 'DestroyDCompositionHwndTarget', 'DestroyIcon', 'DestroyMenu', 'DestroyReasons', 'DestroySyntheticPointerDevice', 'DestroyWindow', 'DialogBoxIndirectParamA', 'DialogBoxIndirectParamAorW', 'DialogBoxIndirectParamW', 'DialogBoxParamA', 'DialogBoxParamW', 'DisableProcessWindowsGhosting', 'DispatchMessageA', 'DispatchMessageW', 'DisplayConfigGetDeviceInfo', 'DisplayConfigSetDeviceInfo', 'DisplayExitWindowsWarnings', 'DlgDirListA', 'DlgDirListComboBoxA', 'DlgDirListComboBoxW', 'DlgDirListW', 'DlgDirSelectComboBoxExA', 'DlgDirSelectComboBoxExW', 'DlgDirSelectExA', 'DlgDirSelectExW', 'DoSoundConnect', 'DoSoundDisconnect', 'DragDetect', 'DragObject', 'DrawAnimatedRects', 'DrawCaption', 'DrawCaptionTempA', 'DrawCaptionTempW', 'DrawEdge', 'DrawFocusRect', 'DrawFrame', 'DrawFrameControl', 'DrawIcon', 'DrawIconEx', 'DrawMenuBar', 'DrawMenuBarTemp', 'DrawStateA', 'DrawStateW', 'DrawTextA', 'DrawTextExA', 'DrawTextExW', 'DrawTextW', 'DwmGetDxRgn', 'DwmGetDxSharedSurface', 'DwmGetRemoteSessionOcclusionEvent', 'DwmGetRemoteSessionOcclusionState', 'DwmKernelShutdown', 'DwmKernelStartup', 'DwmLockScreenUpdates', 'DwmValidateWindow', 'EditWndProc', 'EmptyClipboard', 'EnableMenuItem', 'EnableMouseInPointer', 'EnableNonClientDpiScaling', 'EnableOneCoreTransformMode', 'EnableScrollBar', 'EnableSessionForMMCSS', 'EnableWindow', 'EndDeferWindowPos', 'EndDeferWindowPosEx', 'EndDialog', 'EndMenu', 'EndPaint', 'EndTask', 'EnterReaderModeHelper', 'EnumChildWindows', 'EnumClipboardFormats', 'EnumDesktopWindows', 'EnumDesktopsA', 'EnumDesktopsW', 'EnumDisplayDevicesA', 'EnumDisplayDevicesW', 'EnumDisplayMonitors', 'EnumDisplaySettingsA', 'EnumDisplaySettingsExA', 'EnumDisplaySettingsExW', 'EnumDisplaySettingsW', 'EnumPropsA', 'EnumPropsExA', 'EnumPropsExW', 'EnumPropsW', 'EnumThreadWindows', 'EnumWindowStationsA', 'EnumWindowStationsW', 'EnumWindows', 'EqualRect', 'EvaluateProximityToPolygon', 'EvaluateProximityToRect', 'ExcludeUpdateRgn', 'ExitWindowsEx', 'FillRect', 'FindWindowA', 'FindWindowExA', 'FindWindowExW', 'FindWindowW', 'FlashWindow', 'FlashWindowEx', 'FrameRect', 'FreeDDElParam', 'FrostCrashedWindow', 'GetActiveWindow', 'GetAltTabInfo', 'GetAltTabInfoA', 'GetAltTabInfoW', 'GetAncestor', 'GetAppCompatFlags', 'GetAppCompatFlags2', 'GetAsyncKeyState', 'GetAutoRotationState', 'GetAwarenessFromDpiAwarenessContext', 'GetCIMSSM', 'GetCapture', 'GetCaretBlinkTime', 'GetCaretPos', 'GetClassInfoA', 'GetClassInfoExA', 'GetClassInfoExW', 'GetClassInfoW', 'GetClassLongA', 'GetClassLongPtrA', 'GetClassLongPtrW', 'GetClassLongW', 'GetClassNameA', 'GetClassNameW', 'GetClassWord', 'GetClientRect', 'GetClipCursor', 'GetClipboardAccessToken', 'GetClipboardData', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'GetClipboardOwner', 'GetClipboardSequenceNumber', 'GetClipboardViewer', 'GetComboBoxInfo', 'GetCurrentInputMessageSource', 'GetCursor', 'GetCursorFrameInfo', 'GetCursorInfo', 'GetCursorPos', 'GetDC', 'GetDCEx', 'GetDesktopID', 'GetDesktopWindow', 'GetDialogBaseUnits', 'GetDialogControlDpiChangeBehavior', 'GetDialogDpiChangeBehavior', 'GetDisplayAutoRotationPreferences', 'GetDisplayConfigBufferSizes', 'GetDlgCtrlID', 'GetDlgItem', 'GetDlgItemInt', 'GetDlgItemTextA', 'GetDlgItemTextW', 'GetDoubleClickTime', 'GetDpiForMonitorInternal', 'GetDpiForSystem', 'GetDpiForWindow', 'GetDpiFromDpiAwarenessContext', 'GetFocus', 'GetForegroundWindow', 'GetGUIThreadInfo', 'GetGestureConfig', 'GetGestureExtraArgs', 'GetGestureInfo', 'GetGuiResources', 'GetIconInfo', 'GetIconInfoExA', 'GetIconInfoExW', 'GetInputDesktop', 'GetInputLocaleInfo', 'GetInputState', 'GetInternalWindowPos', 'GetKBCodePage', 'GetKeyNameTextA', 'GetKeyNameTextW', 'GetKeyState', 'GetKeyboardLayout', 'GetKeyboardLayoutList', 'GetKeyboardLayoutNameA', 'GetKeyboardLayoutNameW', 'GetKeyboardState', 'GetKeyboardType', 'GetLastActivePopup', 'GetLastInputInfo', 'GetLayeredWindowAttributes', 'GetListBoxInfo', 'GetMagnificationDesktopColorEffect', 'GetMagnificationDesktopMagnification', 'GetMagnificationDesktopSamplingMode', 'GetMagnificationLensCtxInformation', 'GetMenu', 'GetMenuBarInfo', 'GetMenuCheckMarkDimensions', 'GetMenuContextHelpId', 'GetMenuDefaultItem', 'GetMenuInfo', 'GetMenuItemCount', 'GetMenuItemID', 'GetMenuItemInfoA', 'GetMenuItemInfoW', 'GetMenuItemRect', 'GetMenuState', 'GetMenuStringA', 'GetMenuStringW', 'GetMessageA', 'GetMessageExtraInfo', 'GetMessagePos', 'GetMessageTime', 'GetMessageW', 'GetMonitorInfoA', 'GetMonitorInfoW', 'GetMouseMovePointsEx', 'GetNextDlgGroupItem', 'GetNextDlgTabItem', 'GetOpenClipboardWindow', 'GetParent', 'GetPhysicalCursorPos', 'GetPointerCursorId', 'GetPointerDevice', 'GetPointerDeviceCursors', 'GetPointerDeviceProperties', 'GetPointerDeviceRects', 'GetPointerDevices', 'GetPointerFrameArrivalTimes', 'GetPointerFrameInfo', 'GetPointerFrameInfoHistory', 'GetPointerFramePenInfo', 'GetPointerFramePenInfoHistory', 'GetPointerFrameTouchInfo', 'GetPointerFrameTouchInfoHistory', 'GetPointerInfo', 'GetPointerInfoHistory', 'GetPointerInputTransform', 'GetPointerPenInfo', 'GetPointerPenInfoHistory', 'GetPointerTouchInfo', 'GetPointerTouchInfoHistory', 'GetPointerType', 'GetPriorityClipboardFormat', 'GetProcessDefaultLayout', 'GetProcessDpiAwarenessInternal', 'GetProcessUIContextInformation', 'GetProcessWindowStation', 'GetProgmanWindow', 'GetPropA', 'GetPropW', 'GetQueueStatus', 'GetRawInputBuffer', 'GetRawInputData', 'GetRawInputDeviceInfoA', 'GetRawInputDeviceInfoW', 'GetRawInputDeviceList', 'GetRawPointerDeviceData', 'GetReasonTitleFromReasonCode', 'GetRegisteredRawInputDevices', 'GetScrollBarInfo', 'GetScrollInfo', 'GetScrollPos', 'GetScrollRange', 'GetSendMessageReceiver', 'GetShellChangeNotifyWindow', 'GetShellWindow', 'GetSubMenu', 'GetSysColor', 'GetSysColorBrush', 'GetSystemDpiForProcess', 'GetSystemMenu', 'GetSystemMetrics', 'GetSystemMetricsForDpi', 'GetTabbedTextExtentA', 'GetTabbedTextExtentW', 'GetTaskmanWindow', 'GetThreadDesktop', 'GetThreadDpiAwarenessContext', 'GetThreadDpiHostingBehavior', 'GetTitleBarInfo', 'GetTopLevelWindow', 'GetTopWindow', 'GetTouchInputInfo', 'GetUnpredictedMessagePos', 'GetUpdateRect', 'GetUpdateRgn', 'GetUpdatedClipboardFormats', 'GetUserObjectInformationA', 'GetUserObjectInformationW', 'GetUserObjectSecurity', 'GetWinStationInfo', 'GetWindow', 'GetWindowBand', 'GetWindowCompositionAttribute', 'GetWindowCompositionInfo', 'GetWindowContextHelpId', 'GetWindowDC', 'GetWindowDisplayAffinity', 'GetWindowDpiAwarenessContext', 'GetWindowDpiHostingBehavior', 'GetWindowFeedbackSetting', 'GetWindowInfo', 'GetWindowLongA', 'GetWindowLongPtrA', 'GetWindowLongPtrW', 'GetWindowLongW', 'GetWindowMinimizeRect', 'GetWindowModuleFileName', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'GetWindowPlacement', 'GetWindowProcessHandle', 'GetWindowRect', 'GetWindowRgn', 'GetWindowRgnBox', 'GetWindowRgnEx', 'GetWindowTextA', 'GetWindowTextLengthA', 'GetWindowTextLengthW', 'GetWindowTextW', 'GetWindowThreadProcessId', 'GetWindowWord', 'GhostWindowFromHungWindow', 'GrayStringA', 'GrayStringW', 'HandleDelegatedInput', 'HideCaret', 'HiliteMenuItem', 'HungWindowFromGhostWindow', 'IMPGetIMEA', 'IMPGetIMEW', 'IMPQueryIMEA', 'IMPQueryIMEW', 'IMPSetIMEA', 'IMPSetIMEW', 'ImpersonateDdeClientWindow', 'InSendMessage', 'InSendMessageEx', 'InflateRect', 'InheritWindowMonitor', 'InitDManipHook', 'InitializeGenericHidInjection', 'InitializeInputDeviceInjection', 'InitializeLpkHooks', 'InitializePointerDeviceInjection', 'InitializePointerDeviceInjectionEx', 'InitializeTouchInjection', 'InjectDeviceInput', 'InjectGenericHidInput', 'InjectKeyboardInput', 'InjectMouseInput', 'InjectPointerInput', 'InjectSyntheticPointerInput', 'InjectTouchInput', 'InsertMenuA', 'InsertMenuItemA', 'InsertMenuItemW', 'InsertMenuW', 'InternalGetWindowIcon', 'InternalGetWindowText', 'IntersectRect', 'InvalidateRect', 'InvalidateRgn', 'InvertRect', 'IsCharAlphaA', 'IsCharAlphaNumericA', 'IsCharAlphaNumericW', 'IsCharAlphaW', 'IsCharLowerA', 'IsCharLowerW', 'IsCharUpperA', 'IsCharUpperW', 'IsChild', 'IsClipboardFormatAvailable', 'IsDialogMessage', 'IsDialogMessageA', 'IsDialogMessageW', 'IsDlgButtonChecked', 'IsGUIThread', 'IsHungAppWindow', 'IsIconic', 'IsImmersiveProcess', 'IsInDesktopWindowBand', 'IsMenu', 'IsMouseInPointerEnabled', 'IsOneCoreTransformMode', 'IsProcessDPIAware', 'IsQueueAttached', 'IsRectEmpty', 'IsSETEnabled', 'IsServerSideWindow', 'IsThreadDesktopComposited', 'IsThreadMessageQueueAttached', 'IsThreadTSFEventAware', 'IsTopLevelWindow', 'IsTouchWindow', 'IsValidDpiAwarenessContext', 'IsWinEventHookInstalled', 'IsWindow', 'IsWindowArranged', 'IsWindowEnabled', 'IsWindowInDestroy', 'IsWindowRedirectedForPrint', 'IsWindowUnicode', 'IsWindowVisible', 'IsWow64Message', 'IsZoomed', 'KillTimer', 'LoadAcceleratorsA', 'LoadAcceleratorsW', 'LoadBitmapA', 'LoadBitmapW', 'LoadCursorA', 'LoadCursorFromFileA', 'LoadCursorFromFileW', 'LoadCursorW', 'LoadIconA', 'LoadIconW', 'LoadImageA', 'LoadImageW', 'LoadKeyboardLayoutA', 'LoadKeyboardLayoutEx', 'LoadKeyboardLayoutW', 'LoadLocalFonts', 'LoadMenuA', 'LoadMenuIndirectA', 'LoadMenuIndirectW', 'LoadMenuW', 'LoadRemoteFonts', 'LoadStringA', 'LoadStringW', 'LockSetForegroundWindow', 'LockWindowStation', 'LockWindowUpdate', 'LockWorkStation', 'LogicalToPhysicalPoint', 'LogicalToPhysicalPointForPerMonitorDPI', 'LookupIconIdFromDirectory', 'LookupIconIdFromDirectoryEx', 'MBToWCSEx', 'MBToWCSExt', 'MB_GetString', 'MITActivateInputProcessing', 'MITCoreMsgKGetConnectionHandle', 'MITCoreMsgKOpenConnectionTo', 'MITCoreMsgKSend', 'MITDeactivateInputProcessing', 'MITDisableMouseIntercept', 'MITDispatchCompletion', 'MITEnableMouseIntercept', 'MITGetCursorUpdateHandle', 'MITRegisterManipulationThread', 'MITSetForegroundRoutingInfo', 'MITSetInputCallbacks', 'MITSetInputDelegationMode', 'MITSetLastInputRecipient', 'MITSetManipulationInputTarget', 'MITStopAndEndInertia', 'MITSynthesizeMouseInput', 'MITSynthesizeMouseWheel', 'MITSynthesizeTouchInput', 'MITUpdateInputGlobals', 'MITWaitForMultipleObjectsEx', 'MakeThreadTSFEventAware', 'MapDialogRect', 'MapVirtualKeyA', 'MapVirtualKeyExA', 'MapVirtualKeyExW', 'MapVirtualKeyW', 'MapVisualRelativePoints', 'MapWindowPoints', 'MenuItemFromPoint', 'MenuWindowProcA', 'MenuWindowProcW', 'MessageBeep', 'MessageBoxA', 'MessageBoxExA', 'MessageBoxExW', 'MessageBoxIndirectA', 'MessageBoxIndirectW', 'MessageBoxTimeoutA', 'MessageBoxTimeoutW', 'MessageBoxW', 'ModifyMenuA', 'ModifyMenuW', 'MonitorFromPoint', 'MonitorFromRect', 'MonitorFromWindow', 'MoveWindow', 'MsgWaitForMultipleObjects', 'MsgWaitForMultipleObjectsEx', 'NotifyOverlayWindow', 'NotifyWinEvent', 'OemKeyScan', 'OemToCharA', 'OemToCharBuffA', 'OemToCharBuffW', 'OemToCharW', 'OffsetRect', 'OpenClipboard', 'OpenDesktopA', 'OpenDesktopW', 'OpenIcon', 'OpenInputDesktop', 'OpenThreadDesktop', 'OpenWindowStationA', 'OpenWindowStationW', 'PackDDElParam', 'PackTouchHitTestingProximityEvaluation', 'PaintDesktop', 'PaintMenuBar', 'PaintMonitor', 'PeekMessageA', 'PeekMessageW', 'PhysicalToLogicalPoint', 'PhysicalToLogicalPointForPerMonitorDPI', 'PostMessageA', 'PostMessageW', 'PostQuitMessage', 'PostThreadMessageA', 'PostThreadMessageW', 'PrintWindow', 'PrivateExtractIconExA', 'PrivateExtractIconExW', 'PrivateExtractIconsA', 'PrivateExtractIconsW', 'PrivateRegisterICSProc', 'PtInRect', 'QueryBSDRWindow', 'QueryDisplayConfig', 'QuerySendMessage', 'RIMAddInputObserver', 'RIMAreSiblingDevices', 'RIMDeviceIoControl', 'RIMEnableMonitorMappingForDevice', 'RIMFreeInputBuffer', 'RIMGetDevicePreparsedData', 'RIMGetDevicePreparsedDataLockfree', 'RIMGetDeviceProperties', 'RIMGetDevicePropertiesLockfree', 'RIMGetPhysicalDeviceRect', 'RIMGetSourceProcessId', 'RIMObserveNextInput', 'RIMOnPnpNotification', 'RIMOnTimerNotification', 'RIMReadInput', 'RIMRegisterForInput', 'RIMRemoveInputObserver', 'RIMSetTestModeStatus', 'RIMUnregisterForInput', 'RIMUpdateInputObserverRegistration', 'RealChildWindowFromPoint', 'RealGetWindowClass', 'RealGetWindowClassA', 'RealGetWindowClassW', 'ReasonCodeNeedsBugID', 'ReasonCodeNeedsComment', 'RecordShutdownReason', 'RedrawWindow', 'RegisterBSDRWindow', 'RegisterClassA', 'RegisterClassExA', 'RegisterClassExW', 'RegisterClassW', 'RegisterClipboardFormatA', 'RegisterClipboardFormatW', 'RegisterDManipHook', 'RegisterDeviceNotificationA', 'RegisterDeviceNotificationW', 'RegisterErrorReportingDialog', 'RegisterFrostWindow', 'RegisterGhostWindow', 'RegisterHotKey', 'RegisterLogonProcess', 'RegisterMessagePumpHook', 'RegisterPointerDeviceNotifications', 'RegisterPointerInputTarget', 'RegisterPointerInputTargetEx', 'RegisterPowerSettingNotification', 'RegisterRawInputDevices', 'RegisterServicesProcess', 'RegisterSessionPort', 'RegisterShellHookWindow', 'RegisterSuspendResumeNotification', 'RegisterSystemThread', 'RegisterTasklist', 'RegisterTouchHitTestingWindow', 'RegisterTouchWindow', 'RegisterUserApiHook', 'RegisterWindowMessageA', 'RegisterWindowMessageW', 'ReleaseCapture', 'ReleaseDC', 'ReleaseDwmHitTestWaiters', 'RemoveClipboardFormatListener', 'RemoveInjectionDevice', 'RemoveMenu', 'RemovePropA', 'RemovePropW', 'RemoveThreadTSFEventAwareness', 'ReplyMessage', 'ReportInertia', 'ResolveDesktopForWOW', 'ReuseDDElParam', 'ScreenToClient', 'ScrollChildren', 'ScrollDC', 'ScrollWindow', 'ScrollWindowEx', 'SendDlgItemMessageA', 'SendDlgItemMessageW', 'SendIMEMessageExA', 'SendIMEMessageExW', 'SendInput', 'SendMessageA', 'SendMessageCallbackA', 'SendMessageCallbackW', 'SendMessageTimeoutA', 'SendMessageTimeoutW', 'SendMessageW', 'SendNotifyMessageA', 'SendNotifyMessageW', 'SetActiveWindow', 'SetCapture', 'SetCaretBlinkTime', 'SetCaretPos', 'SetClassLongA', 'SetClassLongPtrA', 'SetClassLongPtrW', 'SetClassLongW', 'SetClassWord', 'SetClipboardData', 'SetClipboardViewer', 'SetCoalescableTimer', 'SetCoreWindow', 'SetCursor', 'SetCursorContents', 'SetCursorPos', 'SetDebugErrorLevel', 'SetDeskWallpaper', 'SetDesktopColorTransform', 'SetDialogControlDpiChangeBehavior', 'SetDialogDpiChangeBehavior', 'SetDisplayAutoRotationPreferences', 'SetDisplayConfig', 'SetDlgItemInt', 'SetDlgItemTextA', 'SetDlgItemTextW', 'SetDoubleClickTime', 'SetFeatureReportResponse', 'SetFocus', 'SetForegroundWindow', 'SetGestureConfig', 'SetInternalWindowPos', 'SetKeyboardState', 'SetLastErrorEx', 'SetLayeredWindowAttributes', 'SetMagnificationDesktopColorEffect', 'SetMagnificationDesktopMagnification', 'SetMagnificationDesktopSamplingMode', 'SetMagnificationLensCtxInformation', 'SetMenu', 'SetMenuContextHelpId', 'SetMenuDefaultItem', 'SetMenuInfo', 'SetMenuItemBitmaps', 'SetMenuItemInfoA', 'SetMenuItemInfoW', 'SetMessageExtraInfo', 'SetMessageQueue', 'SetMirrorRendering', 'SetParent', 'SetPhysicalCursorPos', 'SetPointerDeviceInputSpace', 'SetProcessDPIAware', 'SetProcessDefaultLayout', 'SetProcessDpiAwarenessContext', 'SetProcessDpiAwarenessInternal', 'SetProcessRestrictionExemption', 'SetProcessWindowStation', 'SetProgmanWindow', 'SetPropA', 'SetPropW', 'SetRect', 'SetRectEmpty', 'SetScrollInfo', 'SetScrollPos', 'SetScrollRange', 'SetShellChangeNotifyWindow', 'SetShellWindow', 'SetShellWindowEx', 'SetSysColors', 'SetSysColorsTemp', 'SetSystemCursor', 'SetSystemMenu', 'SetTaskmanWindow', 'SetThreadDesktop', 'SetThreadDpiAwarenessContext', 'SetThreadDpiHostingBehavior', 'SetThreadInputBlocked', 'SetTimer', 'SetUserObjectInformationA', 'SetUserObjectInformationW', 'SetUserObjectSecurity', 'SetWinEventHook', 'SetWindowBand', 'SetWindowCompositionAttribute', 'SetWindowCompositionTransition', 'SetWindowContextHelpId', 'SetWindowDisplayAffinity', 'SetWindowFeedbackSetting', 'SetWindowLongA', 'SetWindowLongPtrA', 'SetWindowLongPtrW', 'SetWindowLongW', 'SetWindowPlacement', 'SetWindowPos', 'SetWindowRgn', 'SetWindowRgnEx', 'SetWindowStationUser', 'SetWindowTextA', 'SetWindowTextW', 'SetWindowWord', 'SetWindowsHookA', 'SetWindowsHookExA', 'SetWindowsHookExW', 'SetWindowsHookW', 'ShowCaret', 'ShowCursor', 'ShowOwnedPopups', 'ShowScrollBar', 'ShowStartGlass', 'ShowSystemCursor', 'ShowWindow', 'ShowWindowAsync', 'ShutdownBlockReasonCreate', 'ShutdownBlockReasonDestroy', 'ShutdownBlockReasonQuery', 'SignalRedirectionStartComplete', 'SkipPointerFrameMessages', 'SoftModalMessageBox', 'SoundSentry', 'SubtractRect', 'SwapMouseButton', 'SwitchDesktop', 'SwitchDesktopWithFade', 'SwitchToThisWindow', 'SystemParametersInfoA', 'SystemParametersInfoForDpi', 'SystemParametersInfoW', 'TabbedTextOutA', 'TabbedTextOutW', 'TileChildWindows', 'TileWindows', 'ToAscii', 'ToAsciiEx', 'ToUnicode', 'ToUnicodeEx', 'TrackMouseEvent', 'TrackPopupMenu', 'TrackPopupMenuEx', 'TranslateAccelerator', 'TranslateAcceleratorA', 'TranslateAcceleratorW', 'TranslateMDISysAccel', 'TranslateMessage', 'TranslateMessageEx', 'UndelegateInput', 'UnhookWinEvent', 'UnhookWindowsHook', 'UnhookWindowsHookEx', 'UnionRect', 'UnloadKeyboardLayout', 'UnlockWindowStation', 'UnpackDDElParam', 'UnregisterClassA', 'UnregisterClassW', 'UnregisterDeviceNotification', 'UnregisterHotKey', 'UnregisterMessagePumpHook', 'UnregisterPointerInputTarget', 'UnregisterPointerInputTargetEx', 'UnregisterPowerSettingNotification', 'UnregisterSessionPort', 'UnregisterSuspendResumeNotification', 'UnregisterTouchWindow', 'UnregisterUserApiHook', 'UpdateDefaultDesktopThumbnail', 'UpdateLayeredWindow', 'UpdateLayeredWindowIndirect', 'UpdatePerUserSystemParameters', 'UpdateWindow', 'UpdateWindowInputSinkHints', 'User32InitializeImmEntryTable', 'UserClientDllInitialize', 'UserHandleGrantAccess', 'UserLpkPSMTextOut', 'UserLpkTabbedTextOut', 'UserRealizePalette', 'UserRegisterWowHandlers', 'VRipOutput', 'VTagOutput', 'ValidateRect', 'ValidateRgn', 'VkKeyScanA', 'VkKeyScanExA', 'VkKeyScanExW', 'VkKeyScanW', 'WCSToMBEx', 'WINNLSEnableIME', 'WINNLSGetEnableStatus', 'WINNLSGetIMEHotkey', 'WaitForInputIdle', 'WaitForRedirectionStartComplete', 'WaitMessage', 'WinHelpA', 'WinHelpW', 'WindowFromDC', 'WindowFromPhysicalPoint', 'WindowFromPoint', '_UserTestTokenForInteractive', 'gSharedInfo', 'gapfnScSendMessage', 'keybd_event', 'mouse_event', 'wsprintfA', 'wsprintfW', 'wvsprintfA', 'wvsprintfW', '_CrtCheckMemory', '_CrtDbgBreak', '_CrtDbgReport', '_CrtDbgReportV', '_CrtDbgReportW', '_CrtDbgReportWV', '_CrtDoForAllClientObjects', '_CrtDumpMemoryLeaks', '_CrtIsMemoryBlock', '_CrtIsValidHeapPointer', '_CrtIsValidPointer', '_CrtMemCheckpoint', '_CrtMemDifference', '_CrtMemDumpAllObjectsSince', '_CrtMemDumpStatistics', '_CrtReportBlockType', '_CrtSetAllocHook', '_CrtSetBreakAlloc', '_CrtSetDbgBlockType', '_CrtSetDbgFlag', '_CrtSetDumpClient', '_CrtSetReportFile', '_CrtSetReportHook', '_CrtSetReportHook2', '_CrtSetReportMode', '_CxxThrowException', '_Getdays', '_Getmonths', '_Gettnames', '_HUGE', '_Strftime', '_W_Getdays', '_W_Getmonths', '_W_Gettnames', '_Wcsftime', '_XcptFilter', '__AdjustPointer', '__C_specific_handler', '__CppXcptFilter', '__CxxFrameHandler', '__CxxFrameHandler2', '__CxxFrameHandler3', '__DestructExceptionObject', '__ExceptionPtrAssign', '__ExceptionPtrCompare', '__ExceptionPtrCopy', '__ExceptionPtrCopyException', '__ExceptionPtrCreate', '__ExceptionPtrCurrentException', '__ExceptionPtrDestroy', '__ExceptionPtrRethrow', '__ExceptionPtrSwap', '__ExceptionPtrToBool', '__RTCastToVoid', '__RTDynamicCast', '__RTtypeid', '__STRINGTOLD', '___lc_codepage_func', '___lc_collate_cp_func', '___lc_handle_func', '___mb_cur_max_func', '___setlc_active_func', '___unguarded_readlc_active_add_func', '__argc', '__argv', '__badioinfo', '__crtCompareStringA', '__crtCompareStringW', '__crtGetLocaleInfoW', '__crtGetStringTypeW', '__crtLCMapStringA', '__crtLCMapStringW', '__daylight', '__dllonexit', '__doserrno', '__dstbias', '__fpecode', '__getmainargs', '__initenv', '__iob_func', '__isascii', '__iscsym', '__iscsymf', '__lc_codepage', '__lc_collate_cp', '__lc_handle', '__lconv_init', '__mb_cur_max', '__pctype_func', '__pioinfo', '__pwctype_func', '__pxcptinfoptrs', '__set_app_type', '__setlc_active', '__setusermatherr', '__strncnt', '__threadhandle', '__threadid', '__toascii', '__unDName', '__unDNameEx', '__uncaught_exception', '__unguarded_readlc_active', '__wargv', '__wcserror', '__wcserror_s', '__wcsncnt', '__wgetmainargs', '__winitenv', '_abs64', '_access', '_access_s', '_acmdln', '_aexit_rtn', '_aligned_free', '_aligned_free_dbg', '_aligned_malloc', '_aligned_malloc_dbg', '_aligned_offset_malloc', '_aligned_offset_malloc_dbg', '_aligned_offset_realloc', '_aligned_offset_realloc_dbg', '_aligned_realloc', '_aligned_realloc_dbg', '_amsg_exit', '_assert', '_atodbl', '_atodbl_l', '_atof_l', '_atoflt_l', '_atoi64', '_atoi64_l', '_atoi_l', '_atol_l', '_atoldbl', '_atoldbl_l', '_beep', '_beginthread', '_beginthreadex', '_c_exit', '_cabs', '_callnewh', '_calloc_dbg', '_cexit', '_cgets', '_cgets_s', '_cgetws', '_cgetws_s', '_chdir', '_chdrive', '_chgsign', '_chgsignf', '_chmod', '_chsize', '_chsize_s', '_chvalidator', '_chvalidator_l', '_clearfp', '_close', '_commit', '_commode', '_control87', '_controlfp', '_controlfp_s', '_copysign', '_copysignf', '_cprintf', '_cprintf_l', '_cprintf_p', '_cprintf_p_l', '_cprintf_s', '_cprintf_s_l', '_cputs', '_cputws', '_creat', '_create_locale', '_crtAssertBusy', '_crtBreakAlloc', '_crtDbgFlag', '_cscanf', '_cscanf_l', '_cscanf_s', '_cscanf_s_l', '_ctime32', '_ctime32_s', '_ctime64', '_ctime64_s', '_ctype', '_cwait', '_cwprintf', '_cwprintf_l', '_cwprintf_p', '_cwprintf_p_l', '_cwprintf_s', '_cwprintf_s_l', '_cwscanf', '_cwscanf_l', '_cwscanf_s', '_cwscanf_s_l', '_daylight', '_difftime32', '_difftime64', '_dstbias', '_dup', '_dup2', '_ecvt', '_ecvt_s', '_endthread', '_endthreadex', '_environ', '_eof', '_errno', '_execl', '_execle', '_execlp', '_execlpe', '_execv', '_execve', '_execvp', '_execvpe', '_exit', '_expand', '_expand_dbg', '_fcloseall', '_fcvt', '_fcvt_s', '_fdopen', '_fgetchar', '_fgetwchar', '_filbuf', '_fileinfo', '_filelength', '_filelengthi64', '_fileno', '_findclose', '_findfirst', '_findfirst64', '_findfirsti64', '_findnext', '_findnext64', '_findnexti64', '_finite', '_finitef', '_flsbuf', '_flushall', '_fmode', '_fpclass', '_fpclassf', '_fpreset', '_fprintf_l', '_fprintf_p', '_fprintf_p_l', '_fprintf_s_l', '_fputchar', '_fputwchar', '_free_dbg', '_free_locale', '_freea', '_freea_s', '_fscanf_l', '_fscanf_s_l', '_fseeki64', '_fsopen', '_fstat', '_fstat64', '_fstati64', '_ftime', '_ftime32', '_ftime32_s', '_ftime64', '_ftime64_s', '_fullpath', '_fullpath_dbg', '_futime', '_futime32', '_futime64', '_fwprintf_l', '_fwprintf_p', '_fwprintf_p_l', '_fwprintf_s_l', '_fwscanf_l', '_fwscanf_s_l', '_gcvt', '_gcvt_s', '_get_current_locale', '_get_doserrno', '_get_environ', '_get_errno', '_get_fileinfo', '_get_fmode', '_get_heap_handle', '_get_osfhandle', '_get_osplatform', '_get_osver', '_get_output_format', '_get_pgmptr', '_get_sbh_threshold', '_get_wenviron', '_get_winmajor', '_get_winminor', '_get_winver', '_get_wpgmptr', '_getch', '_getche', '_getcwd', '_getdcwd', '_getdiskfree', '_getdrive', '_getdrives', '_getmaxstdio', '_getmbcp', '_getpid', '_getsystime', '_getw', '_getwch', '_getwche', '_getws', '_gmtime32', '_gmtime32_s', '_gmtime64', '_gmtime64_s', '_heapchk', '_heapmin', '_heapset', '_heapwalk', '_hypot', '_hypotf', '_i64toa', '_i64toa_s', '_i64tow', '_i64tow_s', '_initterm', '_initterm_e', '_invalid_parameter', '_iob', '_isalnum_l', '_isalpha_l', '_isatty', '_iscntrl_l', '_isctype', '_isctype_l', '_isdigit_l', '_isgraph_l', '_isleadbyte_l', '_islower_l', '_ismbbalnum', '_ismbbalnum_l', '_ismbbalpha', '_ismbbalpha_l', '_ismbbgraph', '_ismbbgraph_l', '_ismbbkalnum', '_ismbbkalnum_l', '_ismbbkana', '_ismbbkana_l', '_ismbbkprint', '_ismbbkprint_l', '_ismbbkpunct', '_ismbbkpunct_l', '_ismbblead', '_ismbblead_l', '_ismbbprint', '_ismbbprint_l', '_ismbbpunct', '_ismbbpunct_l', '_ismbbtrail', '_ismbbtrail_l', '_ismbcalnum', '_ismbcalnum_l', '_ismbcalpha', '_ismbcalpha_l', '_ismbcdigit', '_ismbcdigit_l', '_ismbcgraph', '_ismbcgraph_l', '_ismbchira', '_ismbchira_l', '_ismbckata', '_ismbckata_l', '_ismbcl0', '_ismbcl0_l', '_ismbcl1', '_ismbcl1_l', '_ismbcl2', '_ismbcl2_l', '_ismbclegal', '_ismbclegal_l', '_ismbclower', '_ismbclower_l', '_ismbcprint', '_ismbcprint_l', '_ismbcpunct', '_ismbcpunct_l', '_ismbcspace', '_ismbcspace_l', '_ismbcsymbol', '_ismbcsymbol_l', '_ismbcupper', '_ismbcupper_l', '_ismbslead', '_ismbslead_l', '_ismbstrail', '_ismbstrail_l', '_isnan', '_isnanf', '_isprint_l', '_isspace_l', '_isupper_l', '_iswalnum_l', '_iswalpha_l', '_iswcntrl_l', '_iswctype_l', '_iswdigit_l', '_iswgraph_l', '_iswlower_l', '_iswprint_l', '_iswpunct_l', '_iswspace_l', '_iswupper_l', '_iswxdigit_l', '_isxdigit_l', '_itoa', '_itoa_s', '_itow', '_itow_s', '_j0', '_j1', '_jn', '_kbhit', '_lfind', '_lfind_s', '_local_unwind', '_localtime32', '_localtime32_s', '_localtime64', '_localtime64_s', '_lock', '_locking', '_logb', '_logbf', '_lrotl', '_lrotr', '_lsearch', '_lsearch_s', '_lseek', '_lseeki64', '_ltoa', '_ltoa_s', '_ltow', '_ltow_s', '_makepath', '_makepath_s', '_malloc_dbg', '_mbbtombc', '_mbbtombc_l', '_mbbtype', '_mbcasemap', '_mbccpy', '_mbccpy_l', '_mbccpy_s', '_mbccpy_s_l', '_mbcjistojms', '_mbcjistojms_l', '_mbcjmstojis', '_mbcjmstojis_l', '_mbclen', '_mbclen_l', '_mbctohira', '_mbctohira_l', '_mbctokata', '_mbctokata_l', '_mbctolower', '_mbctolower_l', '_mbctombb', '_mbctombb_l', '_mbctoupper', '_mbctoupper_l', '_mbctype', '_mblen_l', '_mbsbtype', '_mbsbtype_l', '_mbscat', '_mbscat_s', '_mbscat_s_l', '_mbschr', '_mbschr_l', '_mbscmp', '_mbscmp_l', '_mbscoll', '_mbscoll_l', '_mbscpy', '_mbscpy_s', '_mbscpy_s_l', '_mbscspn', '_mbscspn_l', '_mbsdec', '_mbsdec_l', '_mbsdup', '_mbsicmp', '_mbsicmp_l', '_mbsicoll', '_mbsicoll_l', '_mbsinc', '_mbsinc_l', '_mbslen', '_mbslen_l', '_mbslwr', '_mbslwr_l', '_mbslwr_s', '_mbslwr_s_l', '_mbsnbcat', '_mbsnbcat_l', '_mbsnbcat_s', '_mbsnbcat_s_l', '_mbsnbcmp', '_mbsnbcmp_l', '_mbsnbcnt', '_mbsnbcnt_l', '_mbsnbcoll', '_mbsnbcoll_l', '_mbsnbcpy', '_mbsnbcpy_l', '_mbsnbcpy_s', '_mbsnbcpy_s_l', '_mbsnbicmp', '_mbsnbicmp_l', '_mbsnbicoll', '_mbsnbicoll_l', '_mbsnbset', '_mbsnbset_l', '_mbsnbset_s', '_mbsnbset_s_l', '_mbsncat', '_mbsncat_l', '_mbsncat_s', '_mbsncat_s_l', '_mbsnccnt', '_mbsnccnt_l', '_mbsncmp', '_mbsncmp_l', '_mbsncoll', '_mbsncoll_l', '_mbsncpy', '_mbsncpy_l', '_mbsncpy_s', '_mbsncpy_s_l', '_mbsnextc', '_mbsnextc_l', '_mbsnicmp', '_mbsnicmp_l', '_mbsnicoll', '_mbsnicoll_l', '_mbsninc', '_mbsninc_l', '_mbsnlen', '_mbsnlen_l', '_mbsnset', '_mbsnset_l', '_mbsnset_s', '_mbsnset_s_l', '_mbspbrk', '_mbspbrk_l', '_mbsrchr', '_mbsrchr_l', '_mbsrev', '_mbsrev_l', '_mbsset', '_mbsset_l', '_mbsset_s', '_mbsset_s_l', '_mbsspn', '_mbsspn_l', '_mbsspnp', '_mbsspnp_l', '_mbsstr', '_mbsstr_l', '_mbstok', '_mbstok_l', '_mbstok_s', '_mbstok_s_l', '_mbstowcs_l', '_mbstowcs_s_l', '_mbstrlen', '_mbstrlen_l', '_mbstrnlen', '_mbstrnlen_l', '_mbsupr', '_mbsupr_l', '_mbsupr_s', '_mbsupr_s_l', '_mbtowc_l', '_memccpy', '_memicmp', '_memicmp_l', '_mkdir', '_mkgmtime', '_mkgmtime32', '_mkgmtime64', '_mktemp', '_mktemp_s', '_mktime32', '_mktime64', '_msize', '_msize_dbg', '_nextafter', '_nextafterf', '_onexit', '_open', '_open_osfhandle', '_osplatform', '_osver', '_pclose', '_pctype', '_pgmptr', '_pipe', '_popen', '_printf_l', '_printf_p', '_printf_p_l', '_printf_s_l', '_purecall', '_putch', '_putenv', '_putenv_s', '_putw', '_putwch', '_putws', '_pwctype', '_read', '_realloc_dbg', '_resetstkoflw', '_rmdir', '_rmtmp', '_rotl', '_rotl64', '_rotr', '_rotr64', '_scalb', '_scalbf', '_scanf_l', '_scanf_s_l', '_scprintf', '_scprintf_l', '_scprintf_p_l', '_scwprintf', '_scwprintf_l', '_scwprintf_p_l', '_searchenv', '_searchenv_s', '_set_controlfp', '_set_doserrno', '_set_errno', '_set_error_mode', '_set_fileinfo', '_set_fmode', '_set_output_format', '_set_sbh_threshold', '_seterrormode', '_setjmp', '_setjmpex', '_setmaxstdio', '_setmbcp', '_setmode', '_setsystime', '_sleep', '_snprintf', '_snprintf_c', '_snprintf_c_l', '_snprintf_l', '_snprintf_s', '_snprintf_s_l', '_snscanf', '_snscanf_l', '_snscanf_s', '_snscanf_s_l', '_snwprintf', '_snwprintf_l', '_snwprintf_s', '_snwprintf_s_l', '_snwscanf', '_snwscanf_l', '_snwscanf_s', '_snwscanf_s_l', '_sopen', '_sopen_s', '_spawnl', '_spawnle', '_spawnlp', '_spawnlpe', '_spawnv', '_spawnve', '_spawnvp', '_spawnvpe', '_splitpath', '_splitpath_s', '_sprintf_l', '_sprintf_p_l', '_sprintf_s_l', '_sscanf_l', '_sscanf_s_l', '_stat', '_stat64', '_stati64', '_statusfp', '_strcmpi', '_strcoll_l', '_strdate', '_strdate_s', '_strdup', '_strdup_dbg', '_strerror', '_strerror_s', '_stricmp', '_stricmp_l', '_stricoll', '_stricoll_l', '_strlwr', '_strlwr_l', '_strlwr_s', '_strlwr_s_l', '_strncoll', '_strncoll_l', '_strnicmp', '_strnicmp_l', '_strnicoll', '_strnicoll_l', '_strnset', '_strnset_s', '_strrev', '_strset', '_strset_s', '_strtime', '_strtime_s', '_strtod_l', '_strtoi64', '_strtoi64_l', '_strtol_l', '_strtoui64', '_strtoui64_l', '_strtoul_l', '_strupr', '_strupr_l', '_strupr_s', '_strupr_s_l', '_strxfrm_l', '_swab', '_swprintf', '_swprintf_c', '_swprintf_c_l', '_swprintf_p_l', '_swprintf_s_l', '_swscanf_l', '_swscanf_s_l', '_sys_errlist', '_sys_nerr', '_tell', '_telli64', '_tempnam', '_tempnam_dbg', '_time32', '_time64', '_timezone', '_tolower', '_tolower_l', '_toupper', '_toupper_l', '_towlower_l', '_towupper_l', '_tzname', '_tzset', '_ui64toa', '_ui64toa_s', '_ui64tow', '_ui64tow_s', '_ultoa', '_ultoa_s', '_ultow', '_ultow_s', '_umask', '_umask_s', '_ungetch', '_ungetwch', '_unlink', '_unlock', '_utime', '_utime32', '_utime64', '_vcprintf', '_vcprintf_l', '_vcprintf_p', '_vcprintf_p_l', '_vcprintf_s', '_vcprintf_s_l', '_vcwprintf', '_vcwprintf_l', '_vcwprintf_p', '_vcwprintf_p_l', '_vcwprintf_s', '_vcwprintf_s_l', '_vfprintf_l', '_vfprintf_p', '_vfprintf_p_l', '_vfprintf_s_l', '_vfwprintf_l', '_vfwprintf_p', '_vfwprintf_p_l', '_vfwprintf_s_l', '_vprintf_l', '_vprintf_p', '_vprintf_p_l', '_vprintf_s_l', '_vscprintf', '_vscprintf_l', '_vscprintf_p_l', '_vscwprintf', '_vscwprintf_l', '_vscwprintf_p_l', '_vsnprintf', '_vsnprintf_c', '_vsnprintf_c_l', '_vsnprintf_l', '_vsnprintf_s', '_vsnprintf_s_l', '_vsnwprintf', '_vsnwprintf_l', '_vsnwprintf_s', '_vsnwprintf_s_l', '_vsprintf_l', '_vsprintf_p', '_vsprintf_p_l', '_vsprintf_s_l', '_vswprintf', '_vswprintf_c', '_vswprintf_c_l', '_vswprintf_l', '_vswprintf_p_l', '_vswprintf_s_l', '_vwprintf_l', '_vwprintf_p', '_vwprintf_p_l', '_vwprintf_s_l', '_waccess', '_waccess_s', '_wasctime', '_wasctime_s', '_wassert', '_wchdir', '_wchmod', '_wcmdln', '_wcreat', '_wcscoll_l', '_wcsdup', '_wcsdup_dbg', '_wcserror', '_wcserror_s', '_wcsftime_l', '_wcsicmp', '_wcsicmp_l', '_wcsicoll', '_wcsicoll_l', '_wcslwr', '_wcslwr_l', '_wcslwr_s', '_wcslwr_s_l', '_wcsncoll', '_wcsncoll_l', '_wcsnicmp', '_wcsnicmp_l', '_wcsnicoll', '_wcsnicoll_l', '_wcsnset', '_wcsnset_s', '_wcsrev', '_wcsset', '_wcsset_s', '_wcstod_l', '_wcstoi64', '_wcstoi64_l', '_wcstol_l', '_wcstombs_l', '_wcstombs_s_l', '_wcstoui64', '_wcstoui64_l', '_wcstoul_l', '_wcsupr', '_wcsupr_l', '_wcsupr_s', '_wcsupr_s_l', '_wcsxfrm_l', '_wctime', '_wctime32', '_wctime32_s', '_wctime64', '_wctime64_s', '_wctomb_l', '_wctomb_s_l', '_wctype', '_wenviron', '_wexecl', '_wexecle', '_wexeclp', '_wexeclpe', '_wexecv', '_wexecve', '_wexecvp', '_wexecvpe', '_wfdopen', '_wfindfirst', '_wfindfirst64', '_wfindfirsti64', '_wfindnext', '_wfindnext64', '_wfindnexti64', '_wfopen', '_wfopen_s', '_wfreopen', '_wfreopen_s', '_wfsopen', '_wfullpath', '_wfullpath_dbg', '_wgetcwd', '_wgetdcwd', '_wgetenv', '_wgetenv_s', '_winmajor', '_winminor', '_winput_s', '_winver', '_wmakepath', '_wmakepath_s', '_wmkdir', '_wmktemp', '_wmktemp_s', '_wopen', '_woutput_s', '_wperror', '_wpgmptr', '_wpopen', '_wprintf_l', '_wprintf_p', '_wprintf_p_l', '_wprintf_s_l', '_wputenv', '_wputenv_s', '_wremove', '_wrename', '_write', '_wrmdir', '_wscanf_l', '_wscanf_s_l', '_wsearchenv', '_wsearchenv_s', '_wsetlocale', '_wsopen', '_wsopen_s', '_wspawnl', '_wspawnle', '_wspawnlp', '_wspawnlpe', '_wspawnv', '_wspawnve', '_wspawnvp', '_wspawnvpe', '_wsplitpath', '_wsplitpath_s', '_wstat', '_wstat64', '_wstati64', '_wstrdate', '_wstrdate_s', '_wstrtime', '_wstrtime_s', '_wsystem', '_wtempnam', '_wtempnam_dbg', '_wtmpnam', '_wtmpnam_s', '_wtof', '_wtof_l', '_wtoi', '_wtoi64', '_wtoi64_l', '_wtoi_l', '_wtol', '_wtol_l', '_wunlink', '_wutime', '_wutime32', '_wutime64', '_y0', '_y1', '_yn', 'abort', 'abs', 'acos', 'acosf', 'asctime', 'asctime_s', 'asin', 'asinf', 'atan', 'atan2', 'atan2f', 'atanf', 'atexit', 'atof', 'atoi', 'atol', 'bsearch', 'bsearch_s', 'btowc', 'calloc', 'ceil', 'ceilf', 'clearerr', 'clearerr_s', 'clock', 'cos', 'cosf', 'cosh', 'coshf', 'ctime', 'difftime', 'div', 'exit', 'exp', 'expf', 'fabs', 'fclose', 'feof', 'ferror', 'fflush', 'fgetc', 'fgetpos', 'fgets', 'fgetwc', 'fgetws', 'floor', 'floorf', 'fmod', 'fmodf', 'fopen', 'fopen_s', 'fprintf', 'fprintf_s', 'fputc', 'fputs', 'fputwc', 'fputws', 'fread', 'free', 'freopen', 'freopen_s', 'frexp', 'fscanf', 'fscanf_s', 'fseek', 'fsetpos', 'ftell', 'fwprintf', 'fwprintf_s', 'fwrite', 'fwscanf', 'fwscanf_s', 'getc', 'getchar', 'getenv', 'getenv_s', 'gets', 'getwc', 'getwchar', 'gmtime', 'is_wctype', 'isalnum', 'isalpha', 'iscntrl', 'isdigit', 'isgraph', 'isleadbyte', 'islower', 'isprint', 'ispunct', 'isspace', 'isupper', 'iswalnum', 'iswalpha', 'iswascii', 'iswcntrl', 'iswctype', 'iswdigit', 'iswgraph', 'iswlower', 'iswprint', 'iswpunct', 'iswspace', 'iswupper', 'iswxdigit', 'isxdigit', 'labs', 'ldexp', 'ldiv', 'localeconv', 'localtime', 'log', 'log10', 'log10f', 'logf', 'longjmp', 'malloc', 'mblen', 'mbrlen', 'mbrtowc', 'mbsdup_dbg', 'mbsrtowcs', 'mbsrtowcs_s', 'mbstowcs', 'mbstowcs_s', 'mbtowc', 'memchr', 'memcmp', 'memcpy', 'memcpy_s', 'memmove', 'memmove_s', 'memset', 'mktime', 'modf', 'modff', 'perror', 'pow', 'powf', 'printf', 'printf_s', 'putc', 'putchar', 'puts', 'putwc', 'putwchar', 'qsort', 'qsort_s', 'raise', 'rand', 'rand_s', 'realloc', 'remove', 'rename', 'rewind', 'scanf', 'scanf_s', 'setbuf', 'setjmp', 'setlocale', 'setvbuf', 'signal', 'sin', 'sinf', 'sinh', 'sinhf', 'sprintf', 'sprintf_s', 'sqrt', 'sqrtf', 'srand', 'sscanf', 'sscanf_s', 'strcat', 'strcat_s', 'strchr', 'strcmp', 'strcoll', 'strcpy', 'strcpy_s', 'strcspn', 'strerror', 'strerror_s', 'strftime', 'strlen', 'strncat', 'strncat_s', 'strncmp', 'strncpy', 'strncpy_s', 'strnlen', 'strpbrk', 'strrchr', 'strspn', 'strstr', 'strtod', 'strtok', 'strtok_s', 'strtol', 'strtoul', 'strxfrm', 'swprintf', 'swprintf_s', 'swscanf', 'swscanf_s', 'system', 'tan', 'tanf', 'tanh', 'tanhf', 'time', 'tmpfile', 'tmpfile_s', 'tmpnam', 'tmpnam_s', 'tolower', 'toupper', 'towlower', 'towupper', 'ungetc', 'ungetwc', 'utime', 'vfprintf', 'vfprintf_s', 'vfwprintf', 'vfwprintf_s', 'vprintf', 'vprintf_s', 'vsnprintf', 'vsprintf', 'vsprintf_s', 'vswprintf', 'vswprintf_s', 'vwprintf', 'vwprintf_s', 'wcrtomb', 'wcrtomb_s', 'wcscat', 'wcscat_s', 'wcschr', 'wcscmp', 'wcscoll', 'wcscpy', 'wcscpy_s', 'wcscspn', 'wcsftime', 'wcslen', 'wcsncat', 'wcsncat_s', 'wcsncmp', 'wcsncpy', 'wcsncpy_s', 'wcsnlen', 'wcspbrk', 'wcsrchr', 'wcsrtombs', 'wcsrtombs_s', 'wcsspn', 'wcsstr', 'wcstod', 'wcstok', 'wcstok_s', 'wcstol', 'wcstombs', 'wcstombs_s', 'wcstoul', 'wcsxfrm', 'wctob', 'wctomb', 'wctomb_s', 'wprintf', 'wprintf_s', 'wscanf', 'wscanf_s', 'EmptyWorkingSet', 'EnumDeviceDrivers', 'EnumPageFilesA', 'EnumPageFilesW', 'EnumProcessModules', 'EnumProcessModulesEx', 'EnumProcesses', 'GetDeviceDriverBaseNameA', 'GetDeviceDriverBaseNameW', 'GetDeviceDriverFileNameA', 'GetDeviceDriverFileNameW', 'GetMappedFileNameA', 'GetMappedFileNameW', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetModuleFileNameExA', 'GetModuleFileNameExW', 'GetModuleInformation', 'GetPerformanceInfo', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetProcessMemoryInfo', 'GetWsChanges', 'GetWsChangesEx', 'InitializeProcessForWsWatch', 'QueryWorkingSet', 'QueryWorkingSetEx', 'FreeAddrInfoEx', 'FreeAddrInfoExW', 'FreeAddrInfoW', 'GetAddrInfoExA', 'GetAddrInfoExCancel', 'GetAddrInfoExOverlappedResult', 'GetAddrInfoExW', 'GetAddrInfoW', 'GetHostNameW', 'GetNameInfoW', 'InetNtopW', 'InetPtonW', 'SetAddrInfoExA', 'SetAddrInfoExW', 'WEP', 'WPUCompleteOverlappedRequest', 'WPUGetProviderPathEx', 'WSAAccept', 'WSAAddressToStringA', 'WSAAddressToStringW', 'WSAAdvertiseProvider', 'WSAAsyncGetHostByAddr', 'WSAAsyncGetHostByName', 'WSAAsyncGetProtoByName', 'WSAAsyncGetProtoByNumber', 'WSAAsyncGetServByName', 'WSAAsyncGetServByPort', 'WSAAsyncSelect', 'WSACancelAsyncRequest', 'WSACancelBlockingCall', 'WSACleanup', 'WSACloseEvent', 'WSAConnect', 'WSAConnectByList', 'WSAConnectByNameA', 'WSAConnectByNameW', 'WSACreateEvent', 'WSADuplicateSocketA', 'WSADuplicateSocketW', 'WSAEnumNameSpaceProvidersA', 'WSAEnumNameSpaceProvidersExA', 'WSAEnumNameSpaceProvidersExW', 'WSAEnumNameSpaceProvidersW', 'WSAEnumNetworkEvents', 'WSAEnumProtocolsA', 'WSAEnumProtocolsW', 'WSAEventSelect', 'WSAGetLastError', 'WSAGetOverlappedResult', 'WSAGetQOSByName', 'WSAGetServiceClassInfoA', 'WSAGetServiceClassInfoW', 'WSAGetServiceClassNameByClassIdA', 'WSAGetServiceClassNameByClassIdW', 'WSAHtonl', 'WSAHtons', 'WSAInstallServiceClassA', 'WSAInstallServiceClassW', 'WSAIoctl', 'WSAIsBlocking', 'WSAJoinLeaf', 'WSALookupServiceBeginA', 'WSALookupServiceBeginW', 'WSALookupServiceEnd', 'WSALookupServiceNextA', 'WSALookupServiceNextW', 'WSANSPIoctl', 'WSANtohl', 'WSANtohs', 'WSAPoll', 'WSAProviderCompleteAsyncCall', 'WSAProviderConfigChange', 'WSARecv', 'WSARecvDisconnect', 'WSARecvFrom', 'WSARemoveServiceClass', 'WSAResetEvent', 'WSASend', 'WSASendDisconnect', 'WSASendMsg', 'WSASendTo', 'WSASetBlockingHook', 'WSASetEvent', 'WSASetLastError', 'WSASetServiceA', 'WSASetServiceW', 'WSASocketA', 'WSASocketW', 'WSAStartup', 'WSAStringToAddressA', 'WSAStringToAddressW', 'WSAUnadvertiseProvider', 'WSAUnhookBlockingHook', 'WSAWaitForMultipleEvents', 'WSApSetPostRoutine', 'WSCDeinstallProvider', 'WSCDeinstallProvider32', 'WSCDeinstallProviderEx', 'WSCEnableNSProvider', 'WSCEnableNSProvider32', 'WSCEnumNameSpaceProviders32', 'WSCEnumNameSpaceProvidersEx32', 'WSCEnumProtocols', 'WSCEnumProtocols32', 'WSCEnumProtocolsEx', 'WSCGetApplicationCategory', 'WSCGetApplicationCategoryEx', 'WSCGetProviderInfo', 'WSCGetProviderInfo32', 'WSCGetProviderPath', 'WSCGetProviderPath32', 'WSCInstallNameSpace', 'WSCInstallNameSpace32', 'WSCInstallNameSpaceEx', 'WSCInstallNameSpaceEx2', 'WSCInstallNameSpaceEx32', 'WSCInstallProvider', 'WSCInstallProvider64_32', 'WSCInstallProviderAndChains64_32', 'WSCInstallProviderEx', 'WSCSetApplicationCategory', 'WSCSetApplicationCategoryEx', 'WSCSetProviderInfo', 'WSCSetProviderInfo32', 'WSCUnInstallNameSpace', 'WSCUnInstallNameSpace32', 'WSCUnInstallNameSpaceEx2', 'WSCUpdateProvider', 'WSCUpdateProvider32', 'WSCUpdateProviderEx', 'WSCWriteNameSpaceOrder', 'WSCWriteNameSpaceOrder32', 'WSCWriteProviderOrder', 'WSCWriteProviderOrder32', 'WSCWriteProviderOrderEx', 'WahCloseApcHelper', 'WahCloseHandleHelper', 'WahCloseNotificationHandleHelper', 'WahCloseSocketHandle', 'WahCloseThread', 'WahCompleteRequest', 'WahCreateHandleContextTable', 'WahCreateNotificationHandle', 'WahCreateSocketHandle', 'WahDestroyHandleContextTable', 'WahDisableNonIFSHandleSupport', 'WahEnableNonIFSHandleSupport', 'WahEnumerateHandleContexts', 'WahInsertHandleContext', 'WahNotifyAllProcesses', 'WahOpenApcHelper', 'WahOpenCurrentThread', 'WahOpenHandleHelper', 'WahOpenNotificationHandleHelper', 'WahQueueUserApc', 'WahReferenceContextByHandle', 'WahRemoveHandleContext', 'WahWaitForNotification', 'WahWriteLSPEvent', '__WSAFDIsSet', 'accept', 'bind', 'closesocket', 'connect', 'freeaddrinfo', 'getaddrinfo', 'gethostbyaddr', 'gethostbyname', 'gethostname', 'getnameinfo', 'getpeername', 'getprotobyname', 'getprotobynumber', 'getservbyname', 'getservbyport', 'getsockname', 'getsockopt', 'htonl', 'htons', 'inet_addr', 'inet_ntoa', 'inet_ntop', 'inet_pton', 'ioctlsocket', 'listen', 'ntohl', 'ntohs', 'recv', 'recvfrom', 'select', 'send', 'sendto', 'setsockopt', 'shutdown', 'socket', 'AppCacheCheckManifest', 'AppCacheCloseHandle', 'AppCacheCreateAndCommitFile', 'AppCacheDeleteGroup', 'AppCacheDeleteIEGroup', 'AppCacheDuplicateHandle', 'AppCacheFinalize', 'AppCacheFreeDownloadList', 'AppCacheFreeGroupList', 'AppCacheFreeIESpace', 'AppCacheFreeSpace', 'AppCacheGetDownloadList', 'AppCacheGetFallbackUrl', 'AppCacheGetGroupList', 'AppCacheGetIEGroupList', 'AppCacheGetInfo', 'AppCacheGetManifestUrl', 'AppCacheLookup', 'CommitUrlCacheEntryA', 'CommitUrlCacheEntryBinaryBlob', 'CommitUrlCacheEntryW', 'CreateMD5SSOHash', 'CreateUrlCacheContainerA', 'CreateUrlCacheContainerW', 'CreateUrlCacheEntryA', 'CreateUrlCacheEntryExW', 'CreateUrlCacheEntryW', 'CreateUrlCacheGroup', 'DeleteIE3Cache', 'DeleteUrlCacheContainerA', 'DeleteUrlCacheContainerW', 'DeleteUrlCacheEntry', 'DeleteUrlCacheEntryA', 'DeleteUrlCacheEntryW', 'DeleteUrlCacheGroup', 'DeleteWpadCacheForNetworks', 'DetectAutoProxyUrl', 'DispatchAPICall', 'DllCanUnloadNow', 'DllGetClassObject', 'DllInstall', 'DllRegisterServer', 'DllUnregisterServer', 'FindCloseUrlCache', 'FindFirstUrlCacheContainerA', 'FindFirstUrlCacheContainerW', 'FindFirstUrlCacheEntryA', 'FindFirstUrlCacheEntryExA', 'FindFirstUrlCacheEntryExW', 'FindFirstUrlCacheEntryW', 'FindFirstUrlCacheGroup', 'FindNextUrlCacheContainerA', 'FindNextUrlCacheContainerW', 'FindNextUrlCacheEntryA', 'FindNextUrlCacheEntryExA', 'FindNextUrlCacheEntryExW', 'FindNextUrlCacheEntryW', 'FindNextUrlCacheGroup', 'ForceNexusLookup', 'ForceNexusLookupExW', 'FreeUrlCacheSpaceA', 'FreeUrlCacheSpaceW', 'FtpCommandA', 'FtpCommandW', 'FtpCreateDirectoryA', 'FtpCreateDirectoryW', 'FtpDeleteFileA', 'FtpDeleteFileW', 'FtpFindFirstFileA', 'FtpFindFirstFileW', 'FtpGetCurrentDirectoryA', 'FtpGetCurrentDirectoryW', 'FtpGetFileA', 'FtpGetFileEx', 'FtpGetFileSize', 'FtpGetFileW', 'FtpOpenFileA', 'FtpOpenFileW', 'FtpPutFileA', 'FtpPutFileEx', 'FtpPutFileW', 'FtpRemoveDirectoryA', 'FtpRemoveDirectoryW', 'FtpRenameFileA', 'FtpRenameFileW', 'FtpSetCurrentDirectoryA', 'FtpSetCurrentDirectoryW', 'GetProxyDllInfo', 'GetUrlCacheConfigInfoA', 'GetUrlCacheConfigInfoW', 'GetUrlCacheEntryBinaryBlob', 'GetUrlCacheEntryInfoA', 'GetUrlCacheEntryInfoExA', 'GetUrlCacheEntryInfoExW', 'GetUrlCacheEntryInfoW', 'GetUrlCacheGroupAttributeA', 'GetUrlCacheGroupAttributeW', 'GetUrlCacheHeaderData', 'GopherCreateLocatorA', 'GopherCreateLocatorW', 'GopherFindFirstFileA', 'GopherFindFirstFileW', 'GopherGetAttributeA', 'GopherGetAttributeW', 'GopherGetLocatorTypeA', 'GopherGetLocatorTypeW', 'GopherOpenFileA', 'GopherOpenFileW', 'HttpAddRequestHeadersA', 'HttpAddRequestHeadersW', 'HttpCheckDavCompliance', 'HttpCloseDependencyHandle', 'HttpDuplicateDependencyHandle', 'HttpEndRequestA', 'HttpEndRequestW', 'HttpGetServerCredentials', 'HttpGetTunnelSocket', 'HttpIndicatePageLoadComplete', 'HttpIsHostHstsEnabled', 'HttpOpenDependencyHandle', 'HttpOpenRequestA', 'HttpOpenRequestW', 'HttpPushClose', 'HttpPushEnable', 'HttpPushWait', 'HttpQueryInfoA', 'HttpQueryInfoW', 'HttpSendRequestA', 'HttpSendRequestExA', 'HttpSendRequestExW', 'HttpSendRequestW', 'HttpWebSocketClose', 'HttpWebSocketCompleteUpgrade', 'HttpWebSocketQueryCloseStatus', 'HttpWebSocketReceive', 'HttpWebSocketSend', 'HttpWebSocketShutdown', 'IncrementUrlCacheHeaderData', 'InternetAlgIdToStringA', 'InternetAlgIdToStringW', 'InternetAttemptConnect', 'InternetAutodial', 'InternetAutodialCallback', 'InternetAutodialHangup', 'InternetCanonicalizeUrlA', 'InternetCanonicalizeUrlW', 'InternetCheckConnectionA', 'InternetCheckConnectionW', 'InternetClearAllPerSiteCookieDecisions', 'InternetCloseHandle', 'InternetCombineUrlA', 'InternetCombineUrlW', 'InternetConfirmZoneCrossing', 'InternetConfirmZoneCrossingA', 'InternetConfirmZoneCrossingW', 'InternetConnectA', 'InternetConnectW', 'InternetConvertUrlFromWireToWideChar', 'InternetCrackUrlA', 'InternetCrackUrlW', 'InternetCreateUrlA', 'InternetCreateUrlW', 'InternetDial', 'InternetDialA', 'InternetDialW', 'InternetEnumPerSiteCookieDecisionA', 'InternetEnumPerSiteCookieDecisionW', 'InternetErrorDlg', 'InternetFindNextFileA', 'InternetFindNextFileW', 'InternetFortezzaCommand', 'InternetFreeCookies', 'InternetFreeProxyInfoList', 'InternetGetCertByURL', 'InternetGetCertByURLA', 'InternetGetConnectedState', 'InternetGetConnectedStateEx', 'InternetGetConnectedStateExA', 'InternetGetConnectedStateExW', 'InternetGetCookieA', 'InternetGetCookieEx2', 'InternetGetCookieExA', 'InternetGetCookieExW', 'InternetGetCookieW', 'InternetGetLastResponseInfoA', 'InternetGetLastResponseInfoW', 'InternetGetPerSiteCookieDecisionA', 'InternetGetPerSiteCookieDecisionW', 'InternetGetProxyForUrl', 'InternetGetSecurityInfoByURL', 'InternetGetSecurityInfoByURLA', 'InternetGetSecurityInfoByURLW', 'InternetGoOnline', 'InternetGoOnlineA', 'InternetGoOnlineW', 'InternetHangUp', 'InternetInitializeAutoProxyDll', 'InternetLockRequestFile', 'InternetOpenA', 'InternetOpenUrlA', 'InternetOpenUrlW', 'InternetOpenW', 'InternetQueryDataAvailable', 'InternetQueryFortezzaStatus', 'InternetQueryOptionA', 'InternetQueryOptionW', 'InternetReadFile', 'InternetReadFileExA', 'InternetReadFileExW', 'InternetSecurityProtocolToStringA', 'InternetSecurityProtocolToStringW', 'InternetSetCookieA', 'InternetSetCookieEx2', 'InternetSetCookieExA', 'InternetSetCookieExW', 'InternetSetCookieW', 'InternetSetDialState', 'InternetSetDialStateA', 'InternetSetDialStateW', 'InternetSetFilePointer', 'InternetSetOptionA', 'InternetSetOptionExA', 'InternetSetOptionExW', 'InternetSetOptionW', 'InternetSetPerSiteCookieDecisionA', 'InternetSetPerSiteCookieDecisionW', 'InternetSetStatusCallback', 'InternetSetStatusCallbackA', 'InternetSetStatusCallbackW', 'InternetShowSecurityInfoByURL', 'InternetShowSecurityInfoByURLA', 'InternetShowSecurityInfoByURLW', 'InternetTimeFromSystemTime', 'InternetTimeFromSystemTimeA', 'InternetTimeFromSystemTimeW', 'InternetTimeToSystemTime', 'InternetTimeToSystemTimeA', 'InternetTimeToSystemTimeW', 'InternetUnlockRequestFile', 'InternetWriteFile', 'InternetWriteFileExA', 'InternetWriteFileExW', 'IsHostInProxyBypassList', 'IsUrlCacheEntryExpiredA', 'IsUrlCacheEntryExpiredW', 'LoadUrlCacheContent', 'ParseX509EncodedCertificateForListBoxEntry', 'PrivacyGetZonePreferenceW', 'PrivacySetZonePreferenceW', 'ReadUrlCacheEntryStream', 'ReadUrlCacheEntryStreamEx', 'RegisterUrlCacheNotification', 'ResumeSuspendedDownload', 'RetrieveUrlCacheEntryFileA', 'RetrieveUrlCacheEntryFileW', 'RetrieveUrlCacheEntryStreamA', 'RetrieveUrlCacheEntryStreamW', 'RunOnceUrlCache', 'SetUrlCacheConfigInfoA', 'SetUrlCacheConfigInfoW', 'SetUrlCacheEntryGroup', 'SetUrlCacheEntryGroupA', 'SetUrlCacheEntryGroupW', 'SetUrlCacheEntryInfoA', 'SetUrlCacheEntryInfoW', 'SetUrlCacheGroupAttributeA', 'SetUrlCacheGroupAttributeW', 'SetUrlCacheHeaderData', 'ShowCertificate', 'ShowClientAuthCerts', 'ShowSecurityInfo', 'ShowX509EncodedCertificate', 'UnlockUrlCacheEntryFile', 'UnlockUrlCacheEntryFileA', 'UnlockUrlCacheEntryFileW', 'UnlockUrlCacheEntryStream', 'UpdateUrlCacheContentPath', 'UrlCacheCheckEntriesExist', 'UrlCacheCloseEntryHandle', 'UrlCacheContainerSetEntryMaximumAge', 'UrlCacheCreateContainer', 'UrlCacheFindFirstEntry', 'UrlCacheFindNextEntry', 'UrlCacheFreeEntryInfo', 'UrlCacheFreeGlobalSpace', 'UrlCacheGetContentPaths', 'UrlCacheGetEntryInfo', 'UrlCacheGetGlobalCacheSize', 'UrlCacheGetGlobalLimit', 'UrlCacheReadEntryStream', 'UrlCacheReloadSettings', 'UrlCacheRetrieveEntryFile', 'UrlCacheRetrieveEntryStream', 'UrlCacheServer', 'UrlCacheSetGlobalLimit', 'UrlCacheUpdateEntryExtraData', 'UrlZonesDetach', '_GetFileExtensionFromUrl', 'AssocCreate', 'AssocGetPerceivedType', 'AssocIsDangerous', 'AssocQueryKeyA', 'AssocQueryKeyW', 'AssocQueryStringA', 'AssocQueryStringByKeyA', 'AssocQueryStringByKeyW', 'AssocQueryStringW', 'ChrCmpIA', 'ChrCmpIW', 'ColorAdjustLuma', 'ColorHLSToRGB', 'ColorRGBToHLS', 'ConnectToConnectionPoint', 'DelayLoadFailureHook', 'DllGetClassObject', 'DllGetVersion', 'GUIDFromStringW', 'GetAcceptLanguagesA', 'GetAcceptLanguagesW', 'GetMenuPosFromID', 'HashData', 'IStream_Copy', 'IStream_Read', 'IStream_ReadPidl', 'IStream_ReadStr', 'IStream_Reset', 'IStream_Size', 'IStream_Write', 'IStream_WritePidl', 'IStream_WriteStr', 'IUnknown_AtomicRelease', 'IUnknown_Exec', 'IUnknown_GetSite', 'IUnknown_GetWindow', 'IUnknown_QueryService', 'IUnknown_QueryStatus', 'IUnknown_Set', 'IUnknown_SetSite', 'IntlStrEqWorkerA', 'IntlStrEqWorkerW', 'IsCharSpaceA', 'IsCharSpaceW', 'IsInternetESCEnabled', 'IsOS', 'MLLoadLibraryA', 'MLLoadLibraryW', 'ParseURLA', 'ParseURLW', 'PathAddBackslashA', 'PathAddBackslashW', 'PathAddExtensionA', 'PathAddExtensionW', 'PathAppendA', 'PathAppendW', 'PathBuildRootA', 'PathBuildRootW', 'PathCanonicalizeA', 'PathCanonicalizeW', 'PathCombineA', 'PathCombineW', 'PathCommonPrefixA', 'PathCommonPrefixW', 'PathCompactPathA', 'PathCompactPathExA', 'PathCompactPathExW', 'PathCompactPathW', 'PathCreateFromUrlA', 'PathCreateFromUrlAlloc', 'PathCreateFromUrlW', 'PathFileExistsA', 'PathFileExistsAndAttributesW', 'PathFileExistsW', 'PathFindExtensionA', 'PathFindExtensionW', 'PathFindFileNameA', 'PathFindFileNameW', 'PathFindNextComponentA', 'PathFindNextComponentW', 'PathFindOnPathA', 'PathFindOnPathW', 'PathFindSuffixArrayA', 'PathFindSuffixArrayW', 'PathGetArgsA', 'PathGetArgsW', 'PathGetCharTypeA', 'PathGetCharTypeW', 'PathGetDriveNumberA', 'PathGetDriveNumberW', 'PathIsContentTypeA', 'PathIsContentTypeW', 'PathIsDirectoryA', 'PathIsDirectoryEmptyA', 'PathIsDirectoryEmptyW', 'PathIsDirectoryW', 'PathIsFileSpecA', 'PathIsFileSpecW', 'PathIsLFNFileSpecA', 'PathIsLFNFileSpecW', 'PathIsNetworkPathA', 'PathIsNetworkPathW', 'PathIsPrefixA', 'PathIsPrefixW', 'PathIsRelativeA', 'PathIsRelativeW', 'PathIsRootA', 'PathIsRootW', 'PathIsSameRootA', 'PathIsSameRootW', 'PathIsSystemFolderA', 'PathIsSystemFolderW', 'PathIsUNCA', 'PathIsUNCServerA', 'PathIsUNCServerShareA', 'PathIsUNCServerShareW', 'PathIsUNCServerW', 'PathIsUNCW', 'PathIsURLA', 'PathIsURLW', 'PathMakePrettyA', 'PathMakePrettyW', 'PathMakeSystemFolderA', 'PathMakeSystemFolderW', 'PathMatchSpecA', 'PathMatchSpecExA', 'PathMatchSpecExW', 'PathMatchSpecW', 'PathParseIconLocationA', 'PathParseIconLocationW', 'PathQuoteSpacesA', 'PathQuoteSpacesW', 'PathRelativePathToA', 'PathRelativePathToW', 'PathRemoveArgsA', 'PathRemoveArgsW', 'PathRemoveBackslashA', 'PathRemoveBackslashW', 'PathRemoveBlanksA', 'PathRemoveBlanksW', 'PathRemoveExtensionA', 'PathRemoveExtensionW', 'PathRemoveFileSpecA', 'PathRemoveFileSpecW', 'PathRenameExtensionA', 'PathRenameExtensionW', 'PathSearchAndQualifyA', 'PathSearchAndQualifyW', 'PathSetDlgItemPathA', 'PathSetDlgItemPathW', 'PathSkipRootA', 'PathSkipRootW', 'PathStripPathA', 'PathStripPathW', 'PathStripToRootA', 'PathStripToRootW', 'PathUnExpandEnvStringsA', 'PathUnExpandEnvStringsW', 'PathUndecorateA', 'PathUndecorateW', 'PathUnmakeSystemFolderA', 'PathUnmakeSystemFolderW', 'PathUnquoteSpacesA', 'PathUnquoteSpacesW', 'QISearch', 'SHAllocShared', 'SHAnsiToAnsi', 'SHAnsiToUnicode', 'SHAutoComplete', 'SHCopyKeyA', 'SHCopyKeyW', 'SHCreateMemStream', 'SHCreateShellPalette', 'SHCreateStreamOnFileA', 'SHCreateStreamOnFileEx', 'SHCreateStreamOnFileW', 'SHCreateStreamWrapper', 'SHCreateThread', 'SHCreateThreadRef', 'SHCreateThreadWithHandle', 'SHCreateWorkerWindowW', 'SHDeleteEmptyKeyA', 'SHDeleteEmptyKeyW', 'SHDeleteKeyA', 'SHDeleteKeyW', 'SHDeleteOrphanKeyA', 'SHDeleteOrphanKeyW', 'SHDeleteValueA', 'SHDeleteValueW', 'SHEnumKeyExA', 'SHEnumKeyExW', 'SHEnumValueA', 'SHEnumValueW', 'SHFormatDateTimeA', 'SHFormatDateTimeW', 'SHFreeShared', 'SHGetInverseCMAP', 'SHGetThreadRef', 'SHGetValueA', 'SHGetValueW', 'SHGetViewStatePropertyBag', 'SHIsChildOrSelf', 'SHIsLowMemoryMachine', 'SHLoadIndirectString', 'SHLockShared', 'SHMessageBoxCheckA', 'SHMessageBoxCheckW', 'SHOpenRegStream2A', 'SHOpenRegStream2W', 'SHOpenRegStreamA', 'SHOpenRegStreamW', 'SHPackDispParamsV', 'SHPinDllOfCLSID', 'SHPropertyBag_ReadStrAlloc', 'SHPropertyBag_WriteBSTR', 'SHQueryInfoKeyA', 'SHQueryInfoKeyW', 'SHQueryValueExA', 'SHQueryValueExW', 'SHRegCloseUSKey', 'SHRegCreateUSKeyA', 'SHRegCreateUSKeyW', 'SHRegDeleteEmptyUSKeyA', 'SHRegDeleteEmptyUSKeyW', 'SHRegDeleteUSValueA', 'SHRegDeleteUSValueW', 'SHRegDuplicateHKey', 'SHRegEnumUSKeyA', 'SHRegEnumUSKeyW', 'SHRegEnumUSValueA', 'SHRegEnumUSValueW', 'SHRegGetBoolUSValueA', 'SHRegGetBoolUSValueW', 'SHRegGetBoolValueFromHKCUHKLM', 'SHRegGetIntW', 'SHRegGetPathA', 'SHRegGetPathW', 'SHRegGetUSValueA', 'SHRegGetUSValueW', 'SHRegGetValueA', 'SHRegGetValueFromHKCUHKLM', 'SHRegGetValueW', 'SHRegOpenUSKeyA', 'SHRegOpenUSKeyW', 'SHRegQueryInfoUSKeyA', 'SHRegQueryInfoUSKeyW', 'SHRegQueryUSValueA', 'SHRegQueryUSValueW', 'SHRegSetPathA', 'SHRegSetPathW', 'SHRegSetUSValueA', 'SHRegSetUSValueW', 'SHRegWriteUSValueA', 'SHRegWriteUSValueW', 'SHRegisterValidateTemplate', 'SHReleaseThreadRef', 'SHRunIndirectRegClientCommand', 'SHSendMessageBroadcastA', 'SHSendMessageBroadcastW', 'SHSetThreadRef', 'SHSetValueA', 'SHSetValueW', 'SHSkipJunction', 'SHStrDupA', 'SHStrDupW', 'SHStripMneumonicA', 'SHStripMneumonicW', 'SHUnicodeToAnsi', 'SHUnicodeToAnsiCP', 'SHUnicodeToUnicode', 'SHUnlockShared', 'ShellMessageBoxA', 'ShellMessageBoxW', 'StrCSpnA', 'StrCSpnIA', 'StrCSpnIW', 'StrCSpnW', 'StrCatBuffA', 'StrCatBuffW', 'StrCatChainW', 'StrCatW', 'StrChrA', 'StrChrIA', 'StrChrIW', 'StrChrNIW', 'StrChrNW', 'StrChrW', 'StrCmpCA', 'StrCmpCW', 'StrCmpICA', 'StrCmpICW', 'StrCmpIW', 'StrCmpLogicalW', 'StrCmpNA', 'StrCmpNCA', 'StrCmpNCW', 'StrCmpNIA', 'StrCmpNICA', 'StrCmpNICW', 'StrCmpNIW', 'StrCmpNW', 'StrCmpW', 'StrCpyNW', 'StrCpyW', 'StrDupA', 'StrDupW', 'StrFormatByteSize64A', 'StrFormatByteSizeA', 'StrFormatByteSizeEx', 'StrFormatByteSizeW', 'StrFormatKBSizeA', 'StrFormatKBSizeW', 'StrFromTimeIntervalA', 'StrFromTimeIntervalW', 'StrIsIntlEqualA', 'StrIsIntlEqualW', 'StrNCatA', 'StrNCatW', 'StrPBrkA', 'StrPBrkW', 'StrRChrA', 'StrRChrIA', 'StrRChrIW', 'StrRChrW', 'StrRStrIA', 'StrRStrIW', 'StrRetToBSTR', 'StrRetToBufA', 'StrRetToBufW', 'StrRetToStrA', 'StrRetToStrW', 'StrSpnA', 'StrSpnW', 'StrStrA', 'StrStrIA', 'StrStrIW', 'StrStrNIW', 'StrStrNW', 'StrStrW', 'StrToInt64ExA', 'StrToInt64ExW', 'StrToIntA', 'StrToIntExA', 'StrToIntExW', 'StrToIntW', 'StrTrimA', 'StrTrimW', 'UrlApplySchemeA', 'UrlApplySchemeW', 'UrlCanonicalizeA', 'UrlCanonicalizeW', 'UrlCombineA', 'UrlCombineW', 'UrlCompareA', 'UrlCompareW', 'UrlCreateFromPathA', 'UrlCreateFromPathW', 'UrlEscapeA', 'UrlEscapeW', 'UrlFixupW', 'UrlGetLocationA', 'UrlGetLocationW', 'UrlGetPartA', 'UrlGetPartW', 'UrlHashA', 'UrlHashW', 'UrlIsA', 'UrlIsNoHistoryA', 'UrlIsNoHistoryW', 'UrlIsOpaqueA', 'UrlIsOpaqueW', 'UrlIsW', 'UrlUnescapeA', 'UrlUnescapeW', 'WhichPlatform', 'wnsprintfA', 'wnsprintfW', 'wvnsprintfA', 'wvnsprintfW', 'AppCompat_RunDLLW', 'AssocCreateForClasses', 'AssocGetDetailsOfPropKey', 'CDefFolderMenu_Create2', 'CIDLData_CreateFromIDArray', 'CStorageItem_GetValidatedStorageItemObject', 'CheckEscapesW', 'CommandLineToArgvW', 'Control_RunDLL', 'Control_RunDLLA', 'Control_RunDLLAsUserW', 'Control_RunDLLW', 'CreateStorageItemFromPath_FullTrustCaller', 'CreateStorageItemFromPath_FullTrustCaller_ForPackage', 'CreateStorageItemFromPath_PartialTrustCaller', 'CreateStorageItemFromShellItem_FullTrustCaller', 'CreateStorageItemFromShellItem_FullTrustCaller_ForPackage', 'CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle', 'CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage', 'DAD_AutoScroll', 'DAD_DragEnterEx', 'DAD_DragEnterEx2', 'DAD_DragLeave', 'DAD_DragMove', 'DAD_SetDragImage', 'DAD_ShowDragImage', 'DllCanUnloadNow', 'DllGetActivationFactory', 'DllGetClassObject', 'DllGetVersion', 'DllInstall', 'DllRegisterServer', 'DllUnregisterServer', 'DoEnvironmentSubstA', 'DoEnvironmentSubstW', 'DragAcceptFiles', 'DragFinish', 'DragQueryFile', 'DragQueryFileA', 'DragQueryFileAorW', 'DragQueryFileW', 'DragQueryPoint', 'DriveType', 'DuplicateIcon', 'ExtractAssociatedIconA', 'ExtractAssociatedIconExA', 'ExtractAssociatedIconExW', 'ExtractAssociatedIconW', 'ExtractIconA', 'ExtractIconEx', 'ExtractIconExA', 'ExtractIconExW', 'ExtractIconW', 'FindExecutableA', 'FindExecutableW', 'FreeIconList', 'GetCurrentProcessExplicitAppUserModelID', 'GetFileNameFromBrowse', 'GetSystemPersistedStorageItemList', 'ILAppendID', 'ILClone', 'ILCloneFirst', 'ILCombine', 'ILCreateFromPath', 'ILCreateFromPathA', 'ILCreateFromPathW', 'ILFindChild', 'ILFindLastID', 'ILFree', 'ILGetNext', 'ILGetSize', 'ILIsEqual', 'ILIsParent', 'ILLoadFromStreamEx', 'ILRemoveLastID', 'ILSaveToStream', 'InitNetworkAddressControl', 'InternalExtractIconListA', 'InternalExtractIconListW', 'IsDesktopExplorerProcess', 'IsLFNDrive', 'IsLFNDriveA', 'IsLFNDriveW', 'IsNetDrive', 'IsProcessAnExplorer', 'IsUserAnAdmin', 'LaunchMSHelp_RunDLLW', 'OpenAs_RunDLL', 'OpenAs_RunDLLA', 'OpenAs_RunDLLW', 'OpenRegStream', 'Options_RunDLL', 'Options_RunDLLA', 'Options_RunDLLW', 'PathCleanupSpec', 'PathGetShortPath', 'PathIsExe', 'PathIsSlowA', 'PathIsSlowW', 'PathMakeUniqueName', 'PathQualify', 'PathResolve', 'PathYetAnotherMakeUniqueName', 'PickIconDlg', 'PifMgr_CloseProperties', 'PifMgr_GetProperties', 'PifMgr_OpenProperties', 'PifMgr_SetProperties', 'PrepareDiscForBurnRunDllW', 'PrintersGetCommand_RunDLL', 'PrintersGetCommand_RunDLLA', 'PrintersGetCommand_RunDLLW', 'ReadCabinetState', 'RealDriveType', 'RealShellExecuteA', 'RealShellExecuteExA', 'RealShellExecuteExW', 'RealShellExecuteW', 'RegenerateUserEnvironment', 'RestartDialog', 'RestartDialogEx', 'RunAsNewUser_RunDLLW', 'SHAddDefaultPropertiesByExt', 'SHAddFromPropSheetExtArray', 'SHAddToRecentDocs', 'SHAlloc', 'SHAppBarMessage', 'SHAssocEnumHandlers', 'SHAssocEnumHandlersForProtocolByApplication', 'SHBindToFolderIDListParent', 'SHBindToFolderIDListParentEx', 'SHBindToObject', 'SHBindToParent', 'SHBrowseForFolder', 'SHBrowseForFolderA', 'SHBrowseForFolderW', 'SHCLSIDFromString', 'SHChangeNotification_Lock', 'SHChangeNotification_Unlock', 'SHChangeNotify', 'SHChangeNotifyDeregister', 'SHChangeNotifyRegister', 'SHChangeNotifyRegisterThread', 'SHChangeNotifySuspendResume', 'SHCloneSpecialIDList', 'SHCoCreateInstance', 'SHCoCreateInstanceWorker', 'SHCreateAssociationRegistration', 'SHCreateCategoryEnum', 'SHCreateDataObject', 'SHCreateDefaultContextMenu', 'SHCreateDefaultExtractIcon', 'SHCreateDefaultPropertiesOp', 'SHCreateDirectory', 'SHCreateDirectoryExA', 'SHCreateDirectoryExW', 'SHCreateDrvExtIcon', 'SHCreateFileExtractIconW', 'SHCreateItemFromIDList', 'SHCreateItemFromParsingName', 'SHCreateItemFromRelativeName', 'SHCreateItemInKnownFolder', 'SHCreateItemWithParent', 'SHCreateLocalServerRunDll', 'SHCreateProcessAsUserW', 'SHCreatePropSheetExtArray', 'SHCreateQueryCancelAutoPlayMoniker', 'SHCreateShellFolderView', 'SHCreateShellFolderViewEx', 'SHCreateShellItem', 'SHCreateShellItemArray', 'SHCreateShellItemArrayFromDataObject', 'SHCreateShellItemArrayFromIDLists', 'SHCreateShellItemArrayFromShellItem', 'SHCreateStdEnumFmtEtc', 'SHDefExtractIconA', 'SHDefExtractIconW', 'SHDestroyPropSheetExtArray', 'SHDoDragDrop', 'SHELL32_AddToBackIconTable', 'SHELL32_AddToFrontIconTable', 'SHELL32_AreAllItemsAvailable', 'SHELL32_BindToFilePlaceholderHandler', 'SHELL32_CCommonPlacesFolder_CreateInstance', 'SHELL32_CDBurn_CloseSession', 'SHELL32_CDBurn_DriveSupportedForDataBurn', 'SHELL32_CDBurn_Erase', 'SHELL32_CDBurn_GetCDInfo', 'SHELL32_CDBurn_GetLiveFSDiscInfo', 'SHELL32_CDBurn_GetStagingPathOrNormalPath', 'SHELL32_CDBurn_GetTaskInfo', 'SHELL32_CDBurn_IsBlankDisc', 'SHELL32_CDBurn_IsBlankDisc2', 'SHELL32_CDBurn_IsLiveFS', 'SHELL32_CDBurn_OnDeviceChange', 'SHELL32_CDBurn_OnEject', 'SHELL32_CDBurn_OnMediaChange', 'SHELL32_CDefFolderMenu_Create2', 'SHELL32_CDefFolderMenu_Create2Ex', 'SHELL32_CDefFolderMenu_MergeMenu', 'SHELL32_CDrivesContextMenu_Create', 'SHELL32_CDrivesDropTarget_Create', 'SHELL32_CDrives_CreateSFVCB', 'SHELL32_CFSDropTarget_CreateInstance', 'SHELL32_CFSFolderCallback_Create', 'SHELL32_CFillPropertiesTask_CreateInstance', 'SHELL32_CLibraryDropTarget_CreateInstance', 'SHELL32_CLocationContextMenu_Create', 'SHELL32_CLocationFolderUI_CreateInstance', 'SHELL32_CMountPoint_DoAutorun', 'SHELL32_CMountPoint_DoAutorunPrompt', 'SHELL32_CMountPoint_IsAutoRunDriveAndEnabledByPolicy', 'SHELL32_CMountPoint_ProcessAutoRunFile', 'SHELL32_CMountPoint_WantAutorunUI', 'SHELL32_CMountPoint_WantAutorunUIGetReady', 'SHELL32_CPL_CategoryIdArrayFromVariant', 'SHELL32_CPL_IsLegacyCanonicalNameListedUnderKey', 'SHELL32_CPL_ModifyWowDisplayName', 'SHELL32_CRecentDocsContextMenu_CreateInstance', 'SHELL32_CSyncRootManager_CreateInstance', 'SHELL32_CTransferConfirmation_CreateInstance', 'SHELL32_CallFileCopyHooks', 'SHELL32_CanDisplayWin8CopyDialog', 'SHELL32_CloseAutoplayPrompt', 'SHELL32_CommandLineFromMsiDescriptor', 'SHELL32_CopyFilePlaceholderToNewFile', 'SHELL32_CopySecondaryTiles', 'SHELL32_CreateConfirmationInterrupt', 'SHELL32_CreateConflictInterrupt', 'SHELL32_CreateDefaultOperationDataProvider', 'SHELL32_CreateFileFolderContextMenu', 'SHELL32_CreateLinkInfoW', 'SHELL32_CreatePlaceholderFile', 'SHELL32_CreateQosRecorder', 'SHELL32_CreateSharePointView', 'SHELL32_Create_IEnumUICommand', 'SHELL32_DestroyLinkInfo', 'SHELL32_EncryptDirectory', 'SHELL32_EncryptedFileKeyInfo', 'SHELL32_EnumCommonTasks', 'SHELL32_FilePlaceholder_BindToPrimaryStream', 'SHELL32_FilePlaceholder_CreateInstance', 'SHELL32_FreeEncryptedFileKeyInfo', 'SHELL32_GenerateAppID', 'SHELL32_GetAppIDRoot', 'SHELL32_GetCommandProviderForFolderType', 'SHELL32_GetDPIAdjustedLogicalSize', 'SHELL32_GetDiskCleanupPath', 'SHELL32_GetFileNameFromBrowse', 'SHELL32_GetIconOverlayManager', 'SHELL32_GetLinkInfoData', 'SHELL32_GetPlaceholderStatesFromFileAttributesAndReparsePointTag', 'SHELL32_GetRatingBucket', 'SHELL32_GetSkyDriveNetworkStates', 'SHELL32_GetSqmableFileName', 'SHELL32_GetThumbnailAdornerFromFactory', 'SHELL32_GetThumbnailAdornerFromFactory2', 'SHELL32_HandleUnrecognizedFileSystem', 'SHELL32_IconCacheCreate', 'SHELL32_IconCacheDestroy', 'SHELL32_IconCacheHandleAssociationChanged', 'SHELL32_IconCacheRestore', 'SHELL32_IconCache_AboutToExtractIcons', 'SHELL32_IconCache_DoneExtractingIcons', 'SHELL32_IconCache_ExpandEnvAndSearchPath', 'SHELL32_IconCache_RememberRecentlyExtractedIconsW', 'SHELL32_IconOverlayManagerInit', 'SHELL32_IsGetKeyboardLayoutPresent', 'SHELL32_IsSystemUpgradeInProgress', 'SHELL32_IsValidLinkInfo', 'SHELL32_LegacyEnumSpecialTasksByType', 'SHELL32_LegacyEnumTasks', 'SHELL32_LookupBackIconIndex', 'SHELL32_LookupFrontIconIndex', 'SHELL32_NormalizeRating', 'SHELL32_NotifyLinkTrackingServiceOfMove', 'SHELL32_PifMgr_CloseProperties', 'SHELL32_PifMgr_GetProperties', 'SHELL32_PifMgr_OpenProperties', 'SHELL32_PifMgr_SetProperties', 'SHELL32_Printers_CreateBindInfo', 'SHELL32_Printjob_GetPidl', 'SHELL32_PurgeSystemIcon', 'SHELL32_RefreshOverlayImages', 'SHELL32_ResolveLinkInfoW', 'SHELL32_SHAddSparseIcon', 'SHELL32_SHCreateByValueOperationInterrupt', 'SHELL32_SHCreateDefaultContextMenu', 'SHELL32_SHCreateLocalServer', 'SHELL32_SHCreateShellFolderView', 'SHELL32_SHDuplicateEncryptionInfoFile', 'SHELL32_SHEncryptFile', 'SHELL32_SHFormatDriveAsync', 'SHELL32_SHGetThreadUndoManager', 'SHELL32_SHGetUserNameW', 'SHELL32_SHIsVirtualDevice', 'SHELL32_SHLaunchPropSheet', 'SHELL32_SHLogILFromFSIL', 'SHELL32_SHOpenWithDialog', 'SHELL32_SHStartNetConnectionDialogW', 'SHELL32_SHUICommandFromGUID', 'SHELL32_SendToMenu_InvokeTargetedCommand', 'SHELL32_SendToMenu_VerifyTargetedCommand', 'SHELL32_SetPlaceholderReparsePointAttribute', 'SHELL32_SetPlaceholderReparsePointAttribute2', 'SHELL32_ShowHideIconOnlyOnDesktop', 'SHELL32_SimpleRatingToFilterCondition', 'SHELL32_StampIconForFile', 'SHELL32_SuspendUndo', 'SHELL32_TryVirtualDiscImageDriveEject', 'SHELL32_UpdateFilePlaceholderStates', 'SHELL32_VerifySaferTrust', 'SHEmptyRecycleBinA', 'SHEmptyRecycleBinW', 'SHEnableServiceObject', 'SHEnumerateUnreadMailAccountsW', 'SHEvaluateSystemCommandTemplate', 'SHExtractIconsW', 'SHFileOperation', 'SHFileOperationA', 'SHFileOperationW', 'SHFindFiles', 'SHFind_InitMenuPopup', 'SHFlushSFCache', 'SHFormatDrive', 'SHFree', 'SHFreeNameMappings', 'SHGetAttributesFromDataObject', 'SHGetDataFromIDListA', 'SHGetDataFromIDListW', 'SHGetDesktopFolder', 'SHGetDiskFreeSpaceA', 'SHGetDiskFreeSpaceExA', 'SHGetDiskFreeSpaceExW', 'SHGetDriveMedia', 'SHGetFileInfo', 'SHGetFileInfoA', 'SHGetFileInfoW', 'SHGetFolderLocation', 'SHGetFolderPathA', 'SHGetFolderPathAndSubDirA', 'SHGetFolderPathAndSubDirW', 'SHGetFolderPathEx', 'SHGetFolderPathW', 'SHGetIDListFromObject', 'SHGetIconOverlayIndexA', 'SHGetIconOverlayIndexW', 'SHGetImageList', 'SHGetInstanceExplorer', 'SHGetItemFromDataObject', 'SHGetItemFromObject', 'SHGetKnownFolderIDList', 'SHGetKnownFolderItem', 'SHGetKnownFolderPath', 'SHGetLocalizedName', 'SHGetMalloc', 'SHGetNameFromIDList', 'SHGetNewLinkInfo', 'SHGetNewLinkInfoA', 'SHGetNewLinkInfoW', 'SHGetPathFromIDList', 'SHGetPathFromIDListA', 'SHGetPathFromIDListEx', 'SHGetPathFromIDListW', 'SHGetPropertyStoreForWindow', 'SHGetPropertyStoreFromIDList', 'SHGetPropertyStoreFromParsingName', 'SHGetRealIDL', 'SHGetSetFolderCustomSettings', 'SHGetSetSettings', 'SHGetSettings', 'SHGetSpecialFolderLocation', 'SHGetSpecialFolderPathA', 'SHGetSpecialFolderPathW', 'SHGetStockIconInfo', 'SHGetTemporaryPropertyForItem', 'SHGetUnreadMailCountW', 'SHHandleUpdateImage', 'SHHelpShortcuts_RunDLL', 'SHHelpShortcuts_RunDLLA', 'SHHelpShortcuts_RunDLLW', 'SHILCreateFromPath', 'SHInvokePrinterCommandA', 'SHInvokePrinterCommandW', 'SHIsFileAvailableOffline', 'SHLimitInputEdit', 'SHLoadInProc', 'SHLoadNonloadedIconOverlayIdentifiers', 'SHMapPIDLToSystemImageListIndex', 'SHMultiFileProperties', 'SHObjectProperties', 'SHOpenFolderAndSelectItems', 'SHOpenPropSheetW', 'SHOpenWithDialog', 'SHParseDisplayName', 'SHPathPrepareForWriteA', 'SHPathPrepareForWriteW', 'SHPropStgCreate', 'SHPropStgReadMultiple', 'SHPropStgWriteMultiple', 'SHQueryRecycleBinA', 'SHQueryRecycleBinW', 'SHQueryUserNotificationState', 'SHRemoveLocalizedName', 'SHReplaceFromPropSheetExtArray', 'SHResolveLibrary', 'SHRestricted', 'SHSetDefaultProperties', 'SHSetFolderPathA', 'SHSetFolderPathW', 'SHSetInstanceExplorer', 'SHSetKnownFolderPath', 'SHSetLocalizedName', 'SHSetTemporaryPropertyForItem', 'SHSetUnreadMailCountW', 'SHShellFolderView_Message', 'SHShowManageLibraryUI', 'SHSimpleIDListFromPath', 'SHStartNetConnectionDialogW', 'SHTestTokenMembership', 'SHUpdateImageA', 'SHUpdateImageW', 'SHUpdateRecycleBinIcon', 'SHValidateUNC', 'SetCurrentProcessExplicitAppUserModelID', 'SheChangeDirA', 'SheChangeDirExW', 'SheGetDirA', 'SheSetCurDrive', 'ShellAboutA', 'ShellAboutW', 'ShellExec_RunDLL', 'ShellExec_RunDLLA', 'ShellExec_RunDLLW', 'ShellExecuteA', 'ShellExecuteEx', 'ShellExecuteExA', 'ShellExecuteExW', 'ShellExecuteW', 'ShellHookProc', 'ShellMessageBoxA', 'ShellMessageBoxW', 'Shell_GetCachedImageIndex', 'Shell_GetCachedImageIndexA', 'Shell_GetCachedImageIndexW', 'Shell_GetImageLists', 'Shell_MergeMenus', 'Shell_NotifyIcon', 'Shell_NotifyIconA', 'Shell_NotifyIconGetRect', 'Shell_NotifyIconW', 'SignalFileOpen', 'StgMakeUniqueName', 'StrChrA', 'StrChrIA', 'StrChrIW', 'StrChrW', 'StrCmpNA', 'StrCmpNIA', 'StrCmpNIW', 'StrCmpNW', 'StrNCmpA', 'StrNCmpIA', 'StrNCmpIW', 'StrNCmpW', 'StrRChrA', 'StrRChrIA', 'StrRChrIW', 'StrRChrW', 'StrRStrA', 'StrRStrIA', 'StrRStrIW', 'StrRStrW', 'StrStrA', 'StrStrIA', 'StrStrIW', 'StrStrW', 'UsersLibrariesFolderUI_CreateInstance', 'WOWShellExecute', 'WaitForExplorerRestartW', 'Win32DeleteFile', 'WriteCabinetState', 'CertAddCRLContextToStore', 'CertAddCRLLinkToStore', 'CertAddCTLContextToStore', 'CertAddCTLLinkToStore', 'CertAddCertificateContextToStore', 'CertAddCertificateLinkToStore', 'CertAddEncodedCRLToStore', 'CertAddEncodedCTLToStore', 'CertAddEncodedCertificateToStore', 'CertAddEncodedCertificateToSystemStoreA', 'CertAddEncodedCertificateToSystemStoreW', 'CertAddEnhancedKeyUsageIdentifier', 'CertAddRefServerOcspResponse', 'CertAddRefServerOcspResponseContext', 'CertAddSerializedElementToStore', 'CertAddStoreToCollection', 'CertAlgIdToOID', 'CertCloseServerOcspResponse', 'CertCloseStore', 'CertCompareCertificate', 'CertCompareCertificateName', 'CertCompareIntegerBlob', 'CertComparePublicKeyInfo', 'CertControlStore', 'CertCreateCRLContext', 'CertCreateCTLContext', 'CertCreateCTLEntryFromCertificateContextProperties', 'CertCreateCertificateChainEngine', 'CertCreateCertificateContext', 'CertCreateContext', 'CertCreateSelfSignCertificate', 'CertDeleteCRLFromStore', 'CertDeleteCTLFromStore', 'CertDeleteCertificateFromStore', 'CertDuplicateCRLContext', 'CertDuplicateCTLContext', 'CertDuplicateCertificateChain', 'CertDuplicateCertificateContext', 'CertDuplicateStore', 'CertEnumCRLContextProperties', 'CertEnumCRLsInStore', 'CertEnumCTLContextProperties', 'CertEnumCTLsInStore', 'CertEnumCertificateContextProperties', 'CertEnumCertificatesInStore', 'CertEnumPhysicalStore', 'CertEnumSubjectInSortedCTL', 'CertEnumSystemStore', 'CertEnumSystemStoreLocation', 'CertFindAttribute', 'CertFindCRLInStore', 'CertFindCTLInStore', 'CertFindCertificateInCRL', 'CertFindCertificateInStore', 'CertFindChainInStore', 'CertFindExtension', 'CertFindRDNAttr', 'CertFindSubjectInCTL', 'CertFindSubjectInSortedCTL', 'CertFreeCRLContext', 'CertFreeCTLContext', 'CertFreeCertificateChain', 'CertFreeCertificateChainEngine', 'CertFreeCertificateChainList', 'CertFreeCertificateContext', 'CertFreeServerOcspResponseContext', 'CertGetCRLContextProperty', 'CertGetCRLFromStore', 'CertGetCTLContextProperty', 'CertGetCertificateChain', 'CertGetCertificateContextProperty', 'CertGetEnhancedKeyUsage', 'CertGetIntendedKeyUsage', 'CertGetIssuerCertificateFromStore', 'CertGetNameStringA', 'CertGetNameStringW', 'CertGetPublicKeyLength', 'CertGetServerOcspResponseContext', 'CertGetStoreProperty', 'CertGetSubjectCertificateFromStore', 'CertGetValidUsages', 'CertIsRDNAttrsInCertificateName', 'CertIsStrongHashToSign', 'CertIsValidCRLForCertificate', 'CertIsWeakHash', 'CertNameToStrA', 'CertNameToStrW', 'CertOIDToAlgId', 'CertOpenServerOcspResponse', 'CertOpenStore', 'CertOpenSystemStoreA', 'CertOpenSystemStoreW', 'CertRDNValueToStrA', 'CertRDNValueToStrW', 'CertRegisterPhysicalStore', 'CertRegisterSystemStore', 'CertRemoveEnhancedKeyUsageIdentifier', 'CertRemoveStoreFromCollection', 'CertResyncCertificateChainEngine', 'CertRetrieveLogoOrBiometricInfo', 'CertSaveStore', 'CertSelectCertificateChains', 'CertSerializeCRLStoreElement', 'CertSerializeCTLStoreElement', 'CertSerializeCertificateStoreElement', 'CertSetCRLContextProperty', 'CertSetCTLContextProperty', 'CertSetCertificateContextPropertiesFromCTLEntry', 'CertSetCertificateContextProperty', 'CertSetEnhancedKeyUsage', 'CertSetStoreProperty', 'CertStrToNameA', 'CertStrToNameW', 'CertUnregisterPhysicalStore', 'CertUnregisterSystemStore', 'CertVerifyCRLRevocation', 'CertVerifyCRLTimeValidity', 'CertVerifyCTLUsage', 'CertVerifyCertificateChainPolicy', 'CertVerifyRevocation', 'CertVerifySubjectCertificateContext', 'CertVerifyTimeValidity', 'CertVerifyValidityNesting', 'CryptAcquireCertificatePrivateKey', 'CryptBinaryToStringA', 'CryptBinaryToStringW', 'CryptCloseAsyncHandle', 'CryptCreateAsyncHandle', 'CryptCreateKeyIdentifierFromCSP', 'CryptDecodeMessage', 'CryptDecodeObject', 'CryptDecodeObjectEx', 'CryptDecryptAndVerifyMessageSignature', 'CryptDecryptMessage', 'CryptEncodeObject', 'CryptEncodeObjectEx', 'CryptEncryptMessage', 'CryptEnumKeyIdentifierProperties', 'CryptEnumOIDFunction', 'CryptEnumOIDInfo', 'CryptExportPKCS8', 'CryptExportPublicKeyInfo', 'CryptExportPublicKeyInfoEx', 'CryptExportPublicKeyInfoFromBCryptKeyHandle', 'CryptFindCertificateKeyProvInfo', 'CryptFindLocalizedName', 'CryptFindOIDInfo', 'CryptFormatObject', 'CryptFreeOIDFunctionAddress', 'CryptGetAsyncParam', 'CryptGetDefaultOIDDllList', 'CryptGetDefaultOIDFunctionAddress', 'CryptGetKeyIdentifierProperty', 'CryptGetMessageCertificates', 'CryptGetMessageSignerCount', 'CryptGetOIDFunctionAddress', 'CryptGetOIDFunctionValue', 'CryptHashCertificate', 'CryptHashCertificate2', 'CryptHashMessage', 'CryptHashPublicKeyInfo', 'CryptHashToBeSigned', 'CryptImportPKCS8', 'CryptImportPublicKeyInfo', 'CryptImportPublicKeyInfoEx', 'CryptImportPublicKeyInfoEx2', 'CryptInitOIDFunctionSet', 'CryptInstallDefaultContext', 'CryptInstallOIDFunctionAddress', 'CryptLoadSip', 'CryptMemAlloc', 'CryptMemFree', 'CryptMemRealloc', 'CryptMsgCalculateEncodedLength', 'CryptMsgClose', 'CryptMsgControl', 'CryptMsgCountersign', 'CryptMsgCountersignEncoded', 'CryptMsgDuplicate', 'CryptMsgEncodeAndSignCTL', 'CryptMsgGetAndVerifySigner', 'CryptMsgGetParam', 'CryptMsgOpenToDecode', 'CryptMsgOpenToEncode', 'CryptMsgSignCTL', 'CryptMsgUpdate', 'CryptMsgVerifyCountersignatureEncoded', 'CryptMsgVerifyCountersignatureEncodedEx', 'CryptObjectLocatorFree', 'CryptObjectLocatorGet', 'CryptObjectLocatorGetContent', 'CryptObjectLocatorGetUpdated', 'CryptObjectLocatorInitialize', 'CryptObjectLocatorIsChanged', 'CryptObjectLocatorRelease', 'CryptProtectData', 'CryptProtectMemory', 'CryptQueryObject', 'CryptRegisterDefaultOIDFunction', 'CryptRegisterOIDFunction', 'CryptRegisterOIDInfo', 'CryptRetrieveTimeStamp', 'CryptSIPAddProvider', 'CryptSIPCreateIndirectData', 'CryptSIPGetCaps', 'CryptSIPGetSealedDigest', 'CryptSIPGetSignedDataMsg', 'CryptSIPLoad', 'CryptSIPPutSignedDataMsg', 'CryptSIPRemoveProvider', 'CryptSIPRemoveSignedDataMsg', 'CryptSIPRetrieveSubjectGuid', 'CryptSIPRetrieveSubjectGuidForCatalogFile', 'CryptSIPVerifyIndirectData', 'CryptSetAsyncParam', 'CryptSetKeyIdentifierProperty', 'CryptSetOIDFunctionValue', 'CryptSignAndEncodeCertificate', 'CryptSignAndEncryptMessage', 'CryptSignCertificate', 'CryptSignMessage', 'CryptSignMessageWithKey', 'CryptStringToBinaryA', 'CryptStringToBinaryW', 'CryptUninstallDefaultContext', 'CryptUnprotectData', 'CryptUnprotectMemory', 'CryptUnregisterDefaultOIDFunction', 'CryptUnregisterOIDFunction', 'CryptUnregisterOIDInfo', 'CryptUpdateProtectedState', 'CryptVerifyCertificateSignature', 'CryptVerifyCertificateSignatureEx', 'CryptVerifyDetachedMessageHash', 'CryptVerifyDetachedMessageSignature', 'CryptVerifyMessageHash', 'CryptVerifyMessageSignature', 'CryptVerifyMessageSignatureWithKey', 'CryptVerifyTimeStampSignature', 'I_CertChainEngineIsDisallowedCertificate', 'I_CertDiagControl', 'I_CertFinishSslHandshake', 'I_CertProcessSslHandshake', 'I_CertProtectFunction', 'I_CertSrvProtectFunction', 'I_CertSyncStore', 'I_CertUpdateStore', 'I_CertWnfEnableFlushCache', 'I_CryptAddRefLruEntry', 'I_CryptAddSmartCardCertToStore', 'I_CryptAllocTls', 'I_CryptAllocTlsEx', 'I_CryptCreateLruCache', 'I_CryptCreateLruEntry', 'I_CryptDetachTls', 'I_CryptDisableLruOfEntries', 'I_CryptEnableLruOfEntries', 'I_CryptEnumMatchingLruEntries', 'I_CryptFindLruEntry', 'I_CryptFindLruEntryData', 'I_CryptFindSmartCardCertInStore', 'I_CryptFlushLruCache', 'I_CryptFreeLruCache', 'I_CryptFreeTls', 'I_CryptGetAsn1Decoder', 'I_CryptGetAsn1Encoder', 'I_CryptGetDefaultCryptProv', 'I_CryptGetDefaultCryptProvForEncrypt', 'I_CryptGetFileVersion', 'I_CryptGetLruEntryData', 'I_CryptGetLruEntryIdentifier', 'I_CryptGetOssGlobal', 'I_CryptGetTls', 'I_CryptInsertLruEntry', 'I_CryptInstallAsn1Module', 'I_CryptInstallOssGlobal', 'I_CryptReadTrustedPublisherDWORDValueFromRegistry', 'I_CryptRegisterSmartCardStore', 'I_CryptReleaseLruEntry', 'I_CryptRemoveLruEntry', 'I_CryptSetTls', 'I_CryptTouchLruEntry', 'I_CryptUninstallAsn1Module', 'I_CryptUninstallOssGlobal', 'I_CryptUnregisterSmartCardStore', 'I_CryptWalkAllLruCacheEntries', 'I_PFXDecrypt', 'I_PFXHMAC', 'I_PFXImportCertStoreEx', 'PFXExportCertStore', 'PFXExportCertStore2', 'PFXExportCertStoreEx', 'PFXImportCertStore', 'PFXIsPFXBlob', 'PFXVerifyPassword', 'IsInteractiveUserSession', 'QueryActiveSession', 'QueryUserToken', 'RegisterUsertokenForNoWinlogon', 'WTSCloseServer', 'WTSConnectSessionA', 'WTSConnectSessionW', 'WTSCreateListenerA', 'WTSCreateListenerW', 'WTSDisconnectSession', 'WTSEnableChildSessions', 'WTSEnumerateListenersA', 'WTSEnumerateListenersW', 'WTSEnumerateProcessesA', 'WTSEnumerateProcessesExA', 'WTSEnumerateProcessesExW', 'WTSEnumerateProcessesW', 'WTSEnumerateServersA', 'WTSEnumerateServersW', 'WTSEnumerateSessionsA', 'WTSEnumerateSessionsExA', 'WTSEnumerateSessionsExW', 'WTSEnumerateSessionsW', 'WTSFreeMemory', 'WTSFreeMemoryExA', 'WTSFreeMemoryExW', 'WTSGetChildSessionId', 'WTSGetListenerSecurityA', 'WTSGetListenerSecurityW', 'WTSIsChildSessionsEnabled', 'WTSLogoffSession', 'WTSOpenServerA', 'WTSOpenServerExA', 'WTSOpenServerExW', 'WTSOpenServerW', 'WTSQueryListenerConfigA', 'WTSQueryListenerConfigW', 'WTSQuerySessionInformationA', 'WTSQuerySessionInformationW', 'WTSQueryUserConfigA', 'WTSQueryUserConfigW', 'WTSQueryUserToken', 'WTSRegisterSessionNotification', 'WTSRegisterSessionNotificationEx', 'WTSSendMessageA', 'WTSSendMessageW', 'WTSSetListenerSecurityA', 'WTSSetListenerSecurityW', 'WTSSetRenderHint', 'WTSSetSessionInformationA', 'WTSSetSessionInformationW', 'WTSSetUserConfigA', 'WTSSetUserConfigW', 'WTSShutdownSystem', 'WTSStartRemoteControlSessionA', 'WTSStartRemoteControlSessionW', 'WTSStopRemoteControlSession', 'WTSTerminateProcess', 'WTSUnRegisterSessionNotification', 'WTSUnRegisterSessionNotificationEx', 'WTSVirtualChannelClose', 'WTSVirtualChannelOpen', 'WTSVirtualChannelOpenEx', 'WTSVirtualChannelPurgeInput', 'WTSVirtualChannelPurgeOutput', 'WTSVirtualChannelQuery', 'WTSVirtualChannelRead', 'WTSVirtualChannelWrite', 'WTSWaitSystemEvent', 'AsyncGetClassBits', 'AsyncInstallDistributionUnit', 'BindAsyncMoniker', 'CAuthenticateHostUI_CreateInstance', 'CDLGetLongPathNameA', 'CDLGetLongPathNameW', 'CORPolicyProvider', 'CoGetClassObjectFromURL', 'CoInstall', 'CoInternetCanonicalizeIUri', 'CoInternetCombineIUri', 'CoInternetCombineUrl', 'CoInternetCombineUrlEx', 'CoInternetCompareUrl', 'CoInternetCreateSecurityManager', 'CoInternetCreateZoneManager', 'CoInternetFeatureSettingsChanged', 'CoInternetGetMobileBrowserAppCompatMode', 'CoInternetGetMobileBrowserForceDesktopMode', 'CoInternetGetProtocolFlags', 'CoInternetGetSecurityUrl', 'CoInternetGetSecurityUrlEx', 'CoInternetGetSession', 'CoInternetIsFeatureEnabled', 'CoInternetIsFeatureEnabledForIUri', 'CoInternetIsFeatureEnabledForUrl', 'CoInternetIsFeatureZoneElevationEnabled', 'CoInternetParseIUri', 'CoInternetParseUrl', 'CoInternetQueryInfo', 'CoInternetSetFeatureEnabled', 'CoInternetSetMobileBrowserAppCompatMode', 'CoInternetSetMobileBrowserForceDesktopMode', 'CompareSecurityIds', 'CompatFlagsFromClsid', 'CopyBindInfo', 'CopyStgMedium', 'CreateAsyncBindCtx', 'CreateAsyncBindCtxEx', 'CreateFormatEnumerator', 'CreateIUriBuilder', 'CreateURLMoniker', 'CreateURLMonikerEx', 'CreateURLMonikerEx2', 'CreateUri', 'CreateUriFromMultiByteString', 'CreateUriPriv', 'CreateUriWithFragment', 'DllCanUnloadNow', 'DllGetClassObject', 'DllInstall', 'DllRegisterServer', 'DllRegisterServerEx', 'DllUnregisterServer', 'Extract', 'FaultInIEFeature', 'FileBearsMarkOfTheWeb', 'FindMediaType', 'FindMediaTypeClass', 'FindMimeFromData', 'GetAddSitesFileUrl', 'GetClassFileOrMime', 'GetClassURL', 'GetComponentIDFromCLSSPEC', 'GetIDNFlagsForUri', 'GetIUriPriv', 'GetIUriPriv2', 'GetLabelsFromNamedHost', 'GetMarkOfTheWeb', 'GetPortFromUrlScheme', 'GetPropertyFromName', 'GetPropertyName', 'GetSoftwareUpdateInfo', 'GetUrlmonThreadNotificationHwnd', 'GetZoneFromAlternateDataStreamEx', 'HlinkGoBack', 'HlinkGoForward', 'HlinkNavigateMoniker', 'HlinkNavigateString', 'HlinkSimpleNavigateToMoniker', 'HlinkSimpleNavigateToString', 'IECompatLogCSSFix', 'IEGetUserPrivateNamespaceName', 'IEInstallScope', 'IntlPercentEncodeNormalize', 'IsAsyncMoniker', 'IsDWORDProperty', 'IsIntranetAvailable', 'IsJITInProgress', 'IsLoggingEnabledA', 'IsLoggingEnabledW', 'IsStringProperty', 'IsValidURL', 'MkParseDisplayNameEx', 'ObtainUserAgentString', 'PrivateCoInstall', 'QueryAssociations', 'QueryClsidAssociation', 'RegisterBindStatusCallback', 'RegisterFormatEnumerator', 'RegisterMediaTypeClass', 'RegisterMediaTypes', 'RegisterWebPlatformPermanentSecurityManager', 'ReleaseBindInfo', 'RestrictHTTP2', 'RevokeBindStatusCallback', 'RevokeFormatEnumerator', 'SetAccessForIEAppContainer', 'SetSoftwareUpdateAdvertisementState', 'ShouldDisplayPunycodeForUri', 'ShouldShowIntranetWarningSecband', 'ShowTrustAlertDialog', 'URLDownloadA', 'URLDownloadToCacheFileA', 'URLDownloadToCacheFileW', 'URLDownloadToFileA', 'URLDownloadToFileW', 'URLDownloadW', 'URLOpenBlockingStreamA', 'URLOpenBlockingStreamW', 'URLOpenPullStreamA', 'URLOpenPullStreamW', 'URLOpenStreamA', 'URLOpenStreamW', 'UnregisterWebPlatformPermanentSecurityManager', 'UrlMkBuildVersion', 'UrlMkGetSessionOption', 'UrlMkSetSessionOption', 'UrlmonCleanupCurrentThread', 'WriteHitLogging', 'ZonesReInit', 'CMP_GetBlockedDriverInfo', 'CMP_GetServerSideDeviceInstallFlags', 'CMP_Init_Detection', 'CMP_Report_LogOn', 'CMP_WaitNoPendingInstallEvents', 'CMP_WaitServicesAvailable', 'CM_Add_Driver_PackageW', 'CM_Add_Empty_Log_Conf', 'CM_Add_Empty_Log_Conf_Ex', 'CM_Add_IDA', 'CM_Add_IDW', 'CM_Add_ID_ExA', 'CM_Add_ID_ExW', 'CM_Add_Range', 'CM_Add_Res_Des', 'CM_Add_Res_Des_Ex', 'CM_Apply_PowerScheme', 'CM_Connect_MachineA', 'CM_Connect_MachineW', 'CM_Create_DevNodeA', 'CM_Create_DevNodeW', 'CM_Create_DevNode_ExA', 'CM_Create_DevNode_ExW', 'CM_Create_Range_List', 'CM_Delete_Class_Key', 'CM_Delete_Class_Key_Ex', 'CM_Delete_DevNode_Key', 'CM_Delete_DevNode_Key_Ex', 'CM_Delete_Device_Interface_KeyA', 'CM_Delete_Device_Interface_KeyW', 'CM_Delete_Device_Interface_Key_ExA', 'CM_Delete_Device_Interface_Key_ExW', 'CM_Delete_Driver_PackageW', 'CM_Delete_PowerScheme', 'CM_Delete_Range', 'CM_Detect_Resource_Conflict', 'CM_Detect_Resource_Conflict_Ex', 'CM_Disable_DevNode', 'CM_Disable_DevNode_Ex', 'CM_Disconnect_Machine', 'CM_Dup_Range_List', 'CM_Duplicate_PowerScheme', 'CM_Enable_DevNode', 'CM_Enable_DevNode_Ex', 'CM_Enumerate_Classes', 'CM_Enumerate_Classes_Ex', 'CM_Enumerate_EnumeratorsA', 'CM_Enumerate_EnumeratorsW', 'CM_Enumerate_Enumerators_ExA', 'CM_Enumerate_Enumerators_ExW', 'CM_Find_Range', 'CM_First_Range', 'CM_Free_Log_Conf', 'CM_Free_Log_Conf_Ex', 'CM_Free_Log_Conf_Handle', 'CM_Free_Range_List', 'CM_Free_Res_Des', 'CM_Free_Res_Des_Ex', 'CM_Free_Res_Des_Handle', 'CM_Free_Resource_Conflict_Handle', 'CM_Get_Child', 'CM_Get_Child_Ex', 'CM_Get_Class_Key_NameA', 'CM_Get_Class_Key_NameW', 'CM_Get_Class_Key_Name_ExA', 'CM_Get_Class_Key_Name_ExW', 'CM_Get_Class_NameA', 'CM_Get_Class_NameW', 'CM_Get_Class_Name_ExA', 'CM_Get_Class_Name_ExW', 'CM_Get_Class_Registry_PropertyA', 'CM_Get_Class_Registry_PropertyW', 'CM_Get_Depth', 'CM_Get_Depth_Ex', 'CM_Get_DevNode_Custom_PropertyA', 'CM_Get_DevNode_Custom_PropertyW', 'CM_Get_DevNode_Custom_Property_ExA', 'CM_Get_DevNode_Custom_Property_ExW', 'CM_Get_DevNode_Registry_PropertyA', 'CM_Get_DevNode_Registry_PropertyW', 'CM_Get_DevNode_Registry_Property_ExA', 'CM_Get_DevNode_Registry_Property_ExW', 'CM_Get_DevNode_Status', 'CM_Get_DevNode_Status_Ex', 'CM_Get_Device_IDA', 'CM_Get_Device_IDW', 'CM_Get_Device_ID_ExA', 'CM_Get_Device_ID_ExW', 'CM_Get_Device_ID_ListA', 'CM_Get_Device_ID_ListW', 'CM_Get_Device_ID_List_ExA', 'CM_Get_Device_ID_List_ExW', 'CM_Get_Device_ID_List_SizeA', 'CM_Get_Device_ID_List_SizeW', 'CM_Get_Device_ID_List_Size_ExA', 'CM_Get_Device_ID_List_Size_ExW', 'CM_Get_Device_ID_Size', 'CM_Get_Device_ID_Size_Ex', 'CM_Get_Device_Interface_AliasA', 'CM_Get_Device_Interface_AliasW', 'CM_Get_Device_Interface_Alias_ExA', 'CM_Get_Device_Interface_Alias_ExW', 'CM_Get_Device_Interface_ListA', 'CM_Get_Device_Interface_ListW', 'CM_Get_Device_Interface_List_ExA', 'CM_Get_Device_Interface_List_ExW', 'CM_Get_Device_Interface_List_SizeA', 'CM_Get_Device_Interface_List_SizeW', 'CM_Get_Device_Interface_List_Size_ExA', 'CM_Get_Device_Interface_List_Size_ExW', 'CM_Get_First_Log_Conf', 'CM_Get_First_Log_Conf_Ex', 'CM_Get_Global_State', 'CM_Get_Global_State_Ex', 'CM_Get_HW_Prof_FlagsA', 'CM_Get_HW_Prof_FlagsW', 'CM_Get_HW_Prof_Flags_ExA', 'CM_Get_HW_Prof_Flags_ExW', 'CM_Get_Hardware_Profile_InfoA', 'CM_Get_Hardware_Profile_InfoW', 'CM_Get_Hardware_Profile_Info_ExA', 'CM_Get_Hardware_Profile_Info_ExW', 'CM_Get_Log_Conf_Priority', 'CM_Get_Log_Conf_Priority_Ex', 'CM_Get_Next_Log_Conf', 'CM_Get_Next_Log_Conf_Ex', 'CM_Get_Next_Res_Des', 'CM_Get_Next_Res_Des_Ex', 'CM_Get_Parent', 'CM_Get_Parent_Ex', 'CM_Get_Res_Des_Data', 'CM_Get_Res_Des_Data_Ex', 'CM_Get_Res_Des_Data_Size', 'CM_Get_Res_Des_Data_Size_Ex', 'CM_Get_Resource_Conflict_Count', 'CM_Get_Resource_Conflict_DetailsA', 'CM_Get_Resource_Conflict_DetailsW', 'CM_Get_Sibling', 'CM_Get_Sibling_Ex', 'CM_Get_Version', 'CM_Get_Version_Ex', 'CM_Import_PowerScheme', 'CM_Install_DevNodeW', 'CM_Install_DevNode_ExW', 'CM_Intersect_Range_List', 'CM_Invert_Range_List', 'CM_Is_Dock_Station_Present', 'CM_Is_Dock_Station_Present_Ex', 'CM_Is_Version_Available', 'CM_Is_Version_Available_Ex', 'CM_Locate_DevNodeA', 'CM_Locate_DevNodeW', 'CM_Locate_DevNode_ExA', 'CM_Locate_DevNode_ExW', 'CM_Merge_Range_List', 'CM_Modify_Res_Des', 'CM_Modify_Res_Des_Ex', 'CM_Move_DevNode', 'CM_Move_DevNode_Ex', 'CM_Next_Range', 'CM_Open_Class_KeyA', 'CM_Open_Class_KeyW', 'CM_Open_Class_Key_ExA', 'CM_Open_Class_Key_ExW', 'CM_Open_DevNode_Key', 'CM_Open_DevNode_Key_Ex', 'CM_Open_Device_Interface_KeyA', 'CM_Open_Device_Interface_KeyW', 'CM_Open_Device_Interface_Key_ExA', 'CM_Open_Device_Interface_Key_ExW', 'CM_Query_And_Remove_SubTreeA', 'CM_Query_And_Remove_SubTreeW', 'CM_Query_And_Remove_SubTree_ExA', 'CM_Query_And_Remove_SubTree_ExW', 'CM_Query_Arbitrator_Free_Data', 'CM_Query_Arbitrator_Free_Data_Ex', 'CM_Query_Arbitrator_Free_Size', 'CM_Query_Arbitrator_Free_Size_Ex', 'CM_Query_Remove_SubTree', 'CM_Query_Remove_SubTree_Ex', 'CM_Query_Resource_Conflict_List', 'CM_Reenumerate_DevNode', 'CM_Reenumerate_DevNode_Ex', 'CM_Register_Device_Driver', 'CM_Register_Device_Driver_Ex', 'CM_Register_Device_InterfaceA', 'CM_Register_Device_InterfaceW', 'CM_Register_Device_Interface_ExA', 'CM_Register_Device_Interface_ExW', 'CM_Remove_SubTree', 'CM_Remove_SubTree_Ex', 'CM_Request_Device_EjectA', 'CM_Request_Device_EjectW', 'CM_Request_Device_Eject_ExA', 'CM_Request_Device_Eject_ExW', 'CM_Request_Eject_PC', 'CM_Request_Eject_PC_Ex', 'CM_RestoreAll_DefaultPowerSchemes', 'CM_Restore_DefaultPowerScheme', 'CM_Run_Detection', 'CM_Run_Detection_Ex', 'CM_Set_ActiveScheme', 'CM_Set_Class_Registry_PropertyA', 'CM_Set_Class_Registry_PropertyW', 'CM_Set_DevNode_Problem', 'CM_Set_DevNode_Problem_Ex', 'CM_Set_DevNode_Registry_PropertyA', 'CM_Set_DevNode_Registry_PropertyW', 'CM_Set_DevNode_Registry_Property_ExA', 'CM_Set_DevNode_Registry_Property_ExW', 'CM_Set_HW_Prof', 'CM_Set_HW_Prof_Ex', 'CM_Set_HW_Prof_FlagsA', 'CM_Set_HW_Prof_FlagsW', 'CM_Set_HW_Prof_Flags_ExA', 'CM_Set_HW_Prof_Flags_ExW', 'CM_Setup_DevNode', 'CM_Setup_DevNode_Ex', 'CM_Test_Range_Available', 'CM_Uninstall_DevNode', 'CM_Uninstall_DevNode_Ex', 'CM_Unregister_Device_InterfaceA', 'CM_Unregister_Device_InterfaceW', 'CM_Unregister_Device_Interface_ExA', 'CM_Unregister_Device_Interface_ExW', 'CM_Write_UserPowerKey', 'DoesUserHavePrivilege', 'DriverStoreAddDriverPackageA', 'DriverStoreAddDriverPackageW', 'DriverStoreDeleteDriverPackageA', 'DriverStoreDeleteDriverPackageW', 'DriverStoreEnumDriverPackageA', 'DriverStoreEnumDriverPackageW', 'DriverStoreFindDriverPackageA', 'DriverStoreFindDriverPackageW', 'ExtensionPropSheetPageProc', 'InstallCatalog', 'InstallHinfSection', 'InstallHinfSectionA', 'InstallHinfSectionW', 'IsUserAdmin', 'MyFree', 'MyMalloc', 'MyRealloc', 'PnpEnumDrpFile', 'PnpIsFileAclIntact', 'PnpIsFileContentIntact', 'PnpIsFilePnpDriver', 'PnpRepairWindowsProtectedDriver', 'SetupAddInstallSectionToDiskSpaceListA', 'SetupAddInstallSectionToDiskSpaceListW', 'SetupAddSectionToDiskSpaceListA', 'SetupAddSectionToDiskSpaceListW', 'SetupAddToDiskSpaceListA', 'SetupAddToDiskSpaceListW', 'SetupAddToSourceListA', 'SetupAddToSourceListW', 'SetupAdjustDiskSpaceListA', 'SetupAdjustDiskSpaceListW', 'SetupBackupErrorA', 'SetupBackupErrorW', 'SetupCancelTemporarySourceList', 'SetupCloseFileQueue', 'SetupCloseInfFile', 'SetupCloseLog', 'SetupCommitFileQueue', 'SetupCommitFileQueueA', 'SetupCommitFileQueueW', 'SetupConfigureWmiFromInfSectionA', 'SetupConfigureWmiFromInfSectionW', 'SetupCopyErrorA', 'SetupCopyErrorW', 'SetupCopyOEMInfA', 'SetupCopyOEMInfW', 'SetupCreateDiskSpaceListA', 'SetupCreateDiskSpaceListW', 'SetupDecompressOrCopyFileA', 'SetupDecompressOrCopyFileW', 'SetupDefaultQueueCallback', 'SetupDefaultQueueCallbackA', 'SetupDefaultQueueCallbackW', 'SetupDeleteErrorA', 'SetupDeleteErrorW', 'SetupDestroyDiskSpaceList', 'SetupDiApplyPowerScheme', 'SetupDiAskForOEMDisk', 'SetupDiBuildClassInfoList', 'SetupDiBuildClassInfoListExA', 'SetupDiBuildClassInfoListExW', 'SetupDiBuildDriverInfoList', 'SetupDiCallClassInstaller', 'SetupDiCancelDriverInfoSearch', 'SetupDiChangeState', 'SetupDiClassGuidsFromNameA', 'SetupDiClassGuidsFromNameExA', 'SetupDiClassGuidsFromNameExW', 'SetupDiClassGuidsFromNameW', 'SetupDiClassNameFromGuidA', 'SetupDiClassNameFromGuidExA', 'SetupDiClassNameFromGuidExW', 'SetupDiClassNameFromGuidW', 'SetupDiCreateDevRegKeyA', 'SetupDiCreateDevRegKeyW', 'SetupDiCreateDeviceInfoA', 'SetupDiCreateDeviceInfoList', 'SetupDiCreateDeviceInfoListExA', 'SetupDiCreateDeviceInfoListExW', 'SetupDiCreateDeviceInfoW', 'SetupDiCreateDeviceInterfaceA', 'SetupDiCreateDeviceInterfaceRegKeyA', 'SetupDiCreateDeviceInterfaceRegKeyW', 'SetupDiCreateDeviceInterfaceW', 'SetupDiDeleteDevRegKey', 'SetupDiDeleteDeviceInfo', 'SetupDiDeleteDeviceInterfaceData', 'SetupDiDeleteDeviceInterfaceRegKey', 'SetupDiDestroyClassImageList', 'SetupDiDestroyDeviceInfoList', 'SetupDiDestroyDriverInfoList', 'SetupDiDrawMiniIcon', 'SetupDiEnumDeviceInfo', 'SetupDiEnumDeviceInterfaces', 'SetupDiEnumDriverInfoA', 'SetupDiEnumDriverInfoW', 'SetupDiGetActualModelsSectionA', 'SetupDiGetActualModelsSectionW', 'SetupDiGetActualSectionToInstallA', 'SetupDiGetActualSectionToInstallExA', 'SetupDiGetActualSectionToInstallExW', 'SetupDiGetActualSectionToInstallW', 'SetupDiGetClassBitmapIndex', 'SetupDiGetClassDescriptionA', 'SetupDiGetClassDescriptionExA', 'SetupDiGetClassDescriptionExW', 'SetupDiGetClassDescriptionW', 'SetupDiGetClassDevPropertySheetsA', 'SetupDiGetClassDevPropertySheetsW', 'SetupDiGetClassDevsA', 'SetupDiGetClassDevsExA', 'SetupDiGetClassDevsExW', 'SetupDiGetClassDevsW', 'SetupDiGetClassImageIndex', 'SetupDiGetClassImageList', 'SetupDiGetClassImageListExA', 'SetupDiGetClassImageListExW', 'SetupDiGetClassInstallParamsA', 'SetupDiGetClassInstallParamsW', 'SetupDiGetClassPropertyExW', 'SetupDiGetClassPropertyKeys', 'SetupDiGetClassPropertyKeysExW', 'SetupDiGetClassPropertyW', 'SetupDiGetClassRegistryPropertyA', 'SetupDiGetClassRegistryPropertyW', 'SetupDiGetCustomDevicePropertyA', 'SetupDiGetCustomDevicePropertyW', 'SetupDiGetDeviceInfoListClass', 'SetupDiGetDeviceInfoListDetailA', 'SetupDiGetDeviceInfoListDetailW', 'SetupDiGetDeviceInstallParamsA', 'SetupDiGetDeviceInstallParamsW', 'SetupDiGetDeviceInstanceIdA', 'SetupDiGetDeviceInstanceIdW', 'SetupDiGetDeviceInterfaceAlias', 'SetupDiGetDeviceInterfaceDetailA', 'SetupDiGetDeviceInterfaceDetailW', 'SetupDiGetDeviceInterfacePropertyKeys', 'SetupDiGetDeviceInterfacePropertyW', 'SetupDiGetDevicePropertyKeys', 'SetupDiGetDevicePropertyW', 'SetupDiGetDeviceRegistryPropertyA', 'SetupDiGetDeviceRegistryPropertyW', 'SetupDiGetDriverInfoDetailA', 'SetupDiGetDriverInfoDetailW', 'SetupDiGetDriverInstallParamsA', 'SetupDiGetDriverInstallParamsW', 'SetupDiGetHwProfileFriendlyNameA', 'SetupDiGetHwProfileFriendlyNameExA', 'SetupDiGetHwProfileFriendlyNameExW', 'SetupDiGetHwProfileFriendlyNameW', 'SetupDiGetHwProfileList', 'SetupDiGetHwProfileListExA', 'SetupDiGetHwProfileListExW', 'SetupDiGetINFClassA', 'SetupDiGetINFClassW', 'SetupDiGetSelectedDevice', 'SetupDiGetSelectedDriverA', 'SetupDiGetSelectedDriverW', 'SetupDiGetWizardPage', 'SetupDiInstallClassA', 'SetupDiInstallClassExA', 'SetupDiInstallClassExW', 'SetupDiInstallClassW', 'SetupDiInstallDevice', 'SetupDiInstallDeviceInterfaces', 'SetupDiInstallDriverFiles', 'SetupDiLoadClassIcon', 'SetupDiLoadDeviceIcon', 'SetupDiMoveDuplicateDevice', 'SetupDiOpenClassRegKey', 'SetupDiOpenClassRegKeyExA', 'SetupDiOpenClassRegKeyExW', 'SetupDiOpenDevRegKey', 'SetupDiOpenDeviceInfoA', 'SetupDiOpenDeviceInfoW', 'SetupDiOpenDeviceInterfaceA', 'SetupDiOpenDeviceInterfaceRegKey', 'SetupDiOpenDeviceInterfaceW', 'SetupDiRegisterCoDeviceInstallers', 'SetupDiRegisterDeviceInfo', 'SetupDiRemoveDevice', 'SetupDiRemoveDeviceInterface', 'SetupDiReportAdditionalSoftwareRequested', 'SetupDiReportDeviceInstallError', 'SetupDiReportDriverNotFoundError', 'SetupDiReportDriverPackageImportationError', 'SetupDiReportGenericDriverInstalled', 'SetupDiReportPnPDeviceProblem', 'SetupDiRestartDevices', 'SetupDiSelectBestCompatDrv', 'SetupDiSelectDevice', 'SetupDiSelectOEMDrv', 'SetupDiSetClassInstallParamsA', 'SetupDiSetClassInstallParamsW', 'SetupDiSetClassPropertyExW', 'SetupDiSetClassPropertyW', 'SetupDiSetClassRegistryPropertyA', 'SetupDiSetClassRegistryPropertyW', 'SetupDiSetDeviceInstallParamsA', 'SetupDiSetDeviceInstallParamsW', 'SetupDiSetDeviceInterfaceDefault', 'SetupDiSetDeviceInterfacePropertyW', 'SetupDiSetDevicePropertyW', 'SetupDiSetDeviceRegistryPropertyA', 'SetupDiSetDeviceRegistryPropertyW', 'SetupDiSetDriverInstallParamsA', 'SetupDiSetDriverInstallParamsW', 'SetupDiSetSelectedDevice', 'SetupDiSetSelectedDriverA', 'SetupDiSetSelectedDriverW', 'SetupDiUnremoveDevice', 'SetupDuplicateDiskSpaceListA', 'SetupDuplicateDiskSpaceListW', 'SetupEnumInfSectionsA', 'SetupEnumInfSectionsW', 'SetupEnumPublishedInfA', 'SetupEnumPublishedInfW', 'SetupFindFirstLineA', 'SetupFindFirstLineW', 'SetupFindNextLine', 'SetupFindNextMatchLineA', 'SetupFindNextMatchLineW', 'SetupFreeSourceListA', 'SetupFreeSourceListW', 'SetupGetBackupInformationA', 'SetupGetBackupInformationW', 'SetupGetBinaryField', 'SetupGetFieldCount', 'SetupGetFileCompressionInfoA', 'SetupGetFileCompressionInfoExA', 'SetupGetFileCompressionInfoExW', 'SetupGetFileCompressionInfoW', 'SetupGetFileQueueCount', 'SetupGetFileQueueFlags', 'SetupGetInfDriverStoreLocationA', 'SetupGetInfDriverStoreLocationW', 'SetupGetInfFileListA', 'SetupGetInfFileListW', 'SetupGetInfInformationA', 'SetupGetInfInformationW', 'SetupGetInfPublishedNameA', 'SetupGetInfPublishedNameW', 'SetupGetInfSections', 'SetupGetIntField', 'SetupGetLineByIndexA', 'SetupGetLineByIndexW', 'SetupGetLineCountA', 'SetupGetLineCountW', 'SetupGetLineTextA', 'SetupGetLineTextW', 'SetupGetMultiSzFieldA', 'SetupGetMultiSzFieldW', 'SetupGetNonInteractiveMode', 'SetupGetSourceFileLocationA', 'SetupGetSourceFileLocationW', 'SetupGetSourceFileSizeA', 'SetupGetSourceFileSizeW', 'SetupGetSourceInfoA', 'SetupGetSourceInfoW', 'SetupGetStringFieldA', 'SetupGetStringFieldW', 'SetupGetTargetPathA', 'SetupGetTargetPathW', 'SetupGetThreadLogToken', 'SetupInitDefaultQueueCallback', 'SetupInitDefaultQueueCallbackEx', 'SetupInitializeFileLogA', 'SetupInitializeFileLogW', 'SetupInstallFileA', 'SetupInstallFileExA', 'SetupInstallFileExW', 'SetupInstallFileW', 'SetupInstallFilesFromInfSectionA', 'SetupInstallFilesFromInfSectionW', 'SetupInstallFromInfSectionA', 'SetupInstallFromInfSectionW', 'SetupInstallLogCloseEventGroup', 'SetupInstallLogCreateEventGroup', 'SetupInstallServicesFromInfSectionA', 'SetupInstallServicesFromInfSectionExA', 'SetupInstallServicesFromInfSectionExW', 'SetupInstallServicesFromInfSectionW', 'SetupIterateCabinetA', 'SetupIterateCabinetW', 'SetupLogErrorA', 'SetupLogErrorW', 'SetupLogFileA', 'SetupLogFileW', 'SetupOpenAppendInfFileA', 'SetupOpenAppendInfFileW', 'SetupOpenFileQueue', 'SetupOpenInfFileA', 'SetupOpenInfFileW', 'SetupOpenLog', 'SetupOpenMasterInf', 'SetupPrepareQueueForRestoreA', 'SetupPrepareQueueForRestoreW', 'SetupPromptForDiskA', 'SetupPromptForDiskW', 'SetupPromptReboot', 'SetupQueryDrivesInDiskSpaceListA', 'SetupQueryDrivesInDiskSpaceListW', 'SetupQueryFileLogA', 'SetupQueryFileLogW', 'SetupQueryInfFileInformationA', 'SetupQueryInfFileInformationW', 'SetupQueryInfOriginalFileInformationA', 'SetupQueryInfOriginalFileInformationW', 'SetupQueryInfVersionInformationA', 'SetupQueryInfVersionInformationW', 'SetupQuerySourceListA', 'SetupQuerySourceListW', 'SetupQuerySpaceRequiredOnDriveA', 'SetupQuerySpaceRequiredOnDriveW', 'SetupQueueCopyA', 'SetupQueueCopyIndirectA', 'SetupQueueCopyIndirectW', 'SetupQueueCopySectionA', 'SetupQueueCopySectionW', 'SetupQueueCopyW', 'SetupQueueDefaultCopyA', 'SetupQueueDefaultCopyW', 'SetupQueueDeleteA', 'SetupQueueDeleteSectionA', 'SetupQueueDeleteSectionW', 'SetupQueueDeleteW', 'SetupQueueRenameA', 'SetupQueueRenameSectionA', 'SetupQueueRenameSectionW', 'SetupQueueRenameW', 'SetupRemoveFileLogEntryA', 'SetupRemoveFileLogEntryW', 'SetupRemoveFromDiskSpaceListA', 'SetupRemoveFromDiskSpaceListW', 'SetupRemoveFromSourceListA', 'SetupRemoveFromSourceListW', 'SetupRemoveInstallSectionFromDiskSpaceListA', 'SetupRemoveInstallSectionFromDiskSpaceListW', 'SetupRemoveSectionFromDiskSpaceListA', 'SetupRemoveSectionFromDiskSpaceListW', 'SetupRenameErrorA', 'SetupRenameErrorW', 'SetupScanFileQueue', 'SetupScanFileQueueA', 'SetupScanFileQueueW', 'SetupSetDirectoryIdA', 'SetupSetDirectoryIdExA', 'SetupSetDirectoryIdExW', 'SetupSetDirectoryIdW', 'SetupSetFileQueueAlternatePlatformA', 'SetupSetFileQueueAlternatePlatformW', 'SetupSetFileQueueFlags', 'SetupSetNonInteractiveMode', 'SetupSetPlatformPathOverrideA', 'SetupSetPlatformPathOverrideW', 'SetupSetSourceListA', 'SetupSetSourceListW', 'SetupSetThreadLogToken', 'SetupTermDefaultQueueCallback', 'SetupTerminateFileLog', 'SetupUninstallNewlyCopiedInfs', 'SetupUninstallOEMInfA', 'SetupUninstallOEMInfW', 'SetupVerifyInfFileA', 'SetupVerifyInfFileW', 'SetupWriteTextLog', 'SetupWriteTextLogError', 'SetupWriteTextLogInfLine', 'UnicodeToMultiByte', 'VerifyCatalogFile', 'pGetDriverPackageHash', 'pSetupAccessRunOnceNodeList', 'pSetupAddMiniIconToList', 'pSetupAddTagToGroupOrderListEntry', 'pSetupAppendPath', 'pSetupCaptureAndConvertAnsiArg', 'pSetupCenterWindowRelativeToParent', 'pSetupCloseTextLogSection', 'pSetupConcatenatePaths', 'pSetupCreateTextLogSectionA', 'pSetupCreateTextLogSectionW', 'pSetupDestroyRunOnceNodeList', 'pSetupDiBuildInfoDataFromStrongName', 'pSetupDiCrimsonLogDeviceInstall', 'pSetupDiEnumSelectedDrivers', 'pSetupDiGetDriverInfoExtensionId', 'pSetupDiGetStrongNameForDriverNode', 'pSetupDiInvalidateHelperModules', 'pSetupDoLastKnownGoodBackup', 'pSetupDoesUserHavePrivilege', 'pSetupDuplicateString', 'pSetupEnablePrivilege', 'pSetupFree', 'pSetupGetCurrentDriverSigningPolicy', 'pSetupGetDriverDate', 'pSetupGetDriverVersion', 'pSetupGetField', 'pSetupGetFileTitle', 'pSetupGetGlobalFlags', 'pSetupGetIndirectStringsFromDriverInfo', 'pSetupGetInfSections', 'pSetupGetQueueFlags', 'pSetupGetRealSystemTime', 'pSetupGuidFromString', 'pSetupHandleFailedVerification', 'pSetupInfGetDigitalSignatureInfo', 'pSetupInfIsInbox', 'pSetupInfSetDigitalSignatureInfo', 'pSetupInstallCatalog', 'pSetupIsBiDiLocalizedSystemEx', 'pSetupIsGuidNull', 'pSetupIsLocalSystem', 'pSetupIsUserAdmin', 'pSetupIsUserTrustedInstaller', 'pSetupLoadIndirectString', 'pSetupMakeSurePathExists', 'pSetupMalloc', 'pSetupModifyGlobalFlags', 'pSetupMultiByteToUnicode', 'pSetupOpenAndMapFileForRead', 'pSetupOutOfMemory', 'pSetupQueryMultiSzValueToArray', 'pSetupRealloc', 'pSetupRegistryDelnode', 'pSetupRetrieveServiceConfig', 'pSetupSetArrayToMultiSzValue', 'pSetupSetDriverPackageRestorePoint', 'pSetupSetGlobalFlags', 'pSetupSetQueueFlags', 'pSetupShouldDeviceBeExcluded', 'pSetupStringFromGuid', 'pSetupStringTableAddString', 'pSetupStringTableAddStringEx', 'pSetupStringTableDestroy', 'pSetupStringTableDuplicate', 'pSetupStringTableEnum', 'pSetupStringTableGetExtraData', 'pSetupStringTableInitialize', 'pSetupStringTableInitializeEx', 'pSetupStringTableLookUpString', 'pSetupStringTableLookUpStringEx', 'pSetupStringTableSetExtraData', 'pSetupStringTableStringFromId', 'pSetupStringTableStringFromIdEx', 'pSetupUnicodeToMultiByte', 'pSetupUninstallCatalog', 'pSetupUnmapAndCloseFile', 'pSetupValidateDriverPackage', 'pSetupVerifyCatalogFile', 'pSetupVerifyQueuedCatalogs', 'pSetupWriteLogEntry', 'pSetupWriteLogError', 'DavAddConnection', 'DavDeleteConnection', 'DavFlushFile', 'DavGetExtendedError', 'DavGetHTTPFromUNCPath', 'DavGetUNCFromHTTPPath', 'DsAddressToSiteNamesA', 'DsAddressToSiteNamesExA', 'DsAddressToSiteNamesExW', 'DsAddressToSiteNamesW', 'DsDeregisterDnsHostRecordsA', 'DsDeregisterDnsHostRecordsW', 'DsEnumerateDomainTrustsA', 'DsEnumerateDomainTrustsW', 'DsGetDcCloseW', 'DsGetDcNameA', 'DsGetDcNameW', 'DsGetDcNameWithAccountA', 'DsGetDcNameWithAccountW', 'DsGetDcNextA', 'DsGetDcNextW', 'DsGetDcOpenA', 'DsGetDcOpenW', 'DsGetDcSiteCoverageA', 'DsGetDcSiteCoverageW', 'DsGetForestTrustInformationW', 'DsGetSiteNameA', 'DsGetSiteNameW', 'DsMergeForestTrustInformationW', 'DsRoleFreeMemory', 'DsRoleGetPrimaryDomainInformation', 'DsValidateSubnetNameA', 'DsValidateSubnetNameW', 'I_BrowserSetNetlogonState', 'I_DsUpdateReadOnlyServerDnsRecords', 'I_NetAccountDeltas', 'I_NetAccountSync', 'I_NetChainSetClientAttributes', 'I_NetChainSetClientAttributes2', 'I_NetDatabaseDeltas', 'I_NetDatabaseRedo', 'I_NetDatabaseSync', 'I_NetDatabaseSync2', 'I_NetDfsGetVersion', 'I_NetDfsIsThisADomainName', 'I_NetGetDCList', 'I_NetGetForestTrustInformation', 'I_NetLogonControl', 'I_NetLogonControl2', 'I_NetLogonGetDomainInfo', 'I_NetLogonSamLogoff', 'I_NetLogonSamLogon', 'I_NetLogonSamLogonEx', 'I_NetLogonSamLogonWithFlags', 'I_NetLogonSendToSam', 'I_NetLogonUasLogoff', 'I_NetLogonUasLogon', 'I_NetServerAuthenticate', 'I_NetServerAuthenticate2', 'I_NetServerAuthenticate3', 'I_NetServerGetTrustInfo', 'I_NetServerPasswordGet', 'I_NetServerPasswordSet', 'I_NetServerPasswordSet2', 'I_NetServerReqChallenge', 'I_NetServerSetServiceBits', 'I_NetServerSetServiceBitsEx', 'I_NetServerTrustPasswordsGet', 'I_NetlogonComputeClientDigest', 'I_NetlogonComputeServerDigest', 'NetAccessAdd', 'NetAccessDel', 'NetAccessEnum', 'NetAccessGetInfo', 'NetAccessGetUserPerms', 'NetAccessSetInfo', 'NetAddAlternateComputerName', 'NetAddServiceAccount', 'NetAlertRaise', 'NetAlertRaiseEx', 'NetApiBufferAllocate', 'NetApiBufferFree', 'NetApiBufferReallocate', 'NetApiBufferSize', 'NetAuditClear', 'NetAuditRead', 'NetAuditWrite', 'NetConfigGet', 'NetConfigGetAll', 'NetConfigSet', 'NetConnectionEnum', 'NetCreateProvisioningPackage', 'NetDfsAdd', 'NetDfsAddFtRoot', 'NetDfsAddRootTarget', 'NetDfsAddStdRoot', 'NetDfsAddStdRootForced', 'NetDfsEnum', 'NetDfsGetClientInfo', 'NetDfsGetDcAddress', 'NetDfsGetFtContainerSecurity', 'NetDfsGetInfo', 'NetDfsGetSecurity', 'NetDfsGetStdContainerSecurity', 'NetDfsGetSupportedNamespaceVersion', 'NetDfsManagerGetConfigInfo', 'NetDfsManagerInitialize', 'NetDfsManagerSendSiteInfo', 'NetDfsMove', 'NetDfsRemove', 'NetDfsRemoveFtRoot', 'NetDfsRemoveFtRootForced', 'NetDfsRemoveRootTarget', 'NetDfsRemoveStdRoot', 'NetDfsRename', 'NetDfsSetClientInfo', 'NetDfsSetFtContainerSecurity', 'NetDfsSetInfo', 'NetDfsSetSecurity', 'NetDfsSetStdContainerSecurity', 'NetEnumerateComputerNames', 'NetEnumerateServiceAccounts', 'NetEnumerateTrustedDomains', 'NetErrorLogClear', 'NetErrorLogRead', 'NetErrorLogWrite', 'NetFileClose', 'NetFileEnum', 'NetFileGetInfo', 'NetFreeAadJoinInformation', 'NetGetAadJoinInformation', 'NetGetAnyDCName', 'NetGetDCName', 'NetGetDisplayInformationIndex', 'NetGetJoinInformation', 'NetGetJoinableOUs', 'NetGroupAdd', 'NetGroupAddUser', 'NetGroupDel', 'NetGroupDelUser', 'NetGroupEnum', 'NetGroupGetInfo', 'NetGroupGetUsers', 'NetGroupSetInfo', 'NetGroupSetUsers', 'NetIsServiceAccount', 'NetJoinDomain', 'NetLocalGroupAdd', 'NetLocalGroupAddMember', 'NetLocalGroupAddMembers', 'NetLocalGroupDel', 'NetLocalGroupDelMember', 'NetLocalGroupDelMembers', 'NetLocalGroupEnum', 'NetLocalGroupGetInfo', 'NetLocalGroupGetMembers', 'NetLocalGroupSetInfo', 'NetLocalGroupSetMembers', 'NetLogonGetTimeServiceParentDomain', 'NetLogonSetServiceBits', 'NetMessageBufferSend', 'NetMessageNameAdd', 'NetMessageNameDel', 'NetMessageNameEnum', 'NetMessageNameGetInfo', 'NetProvisionComputerAccount', 'NetQueryDisplayInformation', 'NetQueryServiceAccount', 'NetRegisterDomainNameChangeNotification', 'NetRemoteComputerSupports', 'NetRemoteTOD', 'NetRemoveAlternateComputerName', 'NetRemoveServiceAccount', 'NetRenameMachineInDomain', 'NetReplExportDirAdd', 'NetReplExportDirDel', 'NetReplExportDirEnum', 'NetReplExportDirGetInfo', 'NetReplExportDirLock', 'NetReplExportDirSetInfo', 'NetReplExportDirUnlock', 'NetReplGetInfo', 'NetReplImportDirAdd', 'NetReplImportDirDel', 'NetReplImportDirEnum', 'NetReplImportDirGetInfo', 'NetReplImportDirLock', 'NetReplImportDirUnlock', 'NetReplSetInfo', 'NetRequestOfflineDomainJoin', 'NetRequestProvisioningPackageInstall', 'NetScheduleJobAdd', 'NetScheduleJobDel', 'NetScheduleJobEnum', 'NetScheduleJobGetInfo', 'NetServerAliasAdd', 'NetServerAliasDel', 'NetServerAliasEnum', 'NetServerComputerNameAdd', 'NetServerComputerNameDel', 'NetServerDiskEnum', 'NetServerEnum', 'NetServerEnumEx', 'NetServerGetInfo', 'NetServerSetInfo', 'NetServerTransportAdd', 'NetServerTransportAddEx', 'NetServerTransportDel', 'NetServerTransportEnum', 'NetServiceControl', 'NetServiceEnum', 'NetServiceGetInfo', 'NetServiceInstall', 'NetSessionDel', 'NetSessionEnum', 'NetSessionGetInfo', 'NetSetPrimaryComputerName', 'NetShareAdd', 'NetShareCheck', 'NetShareDel', 'NetShareDelEx', 'NetShareDelSticky', 'NetShareEnum', 'NetShareEnumSticky', 'NetShareGetInfo', 'NetShareSetInfo', 'NetStatisticsGet', 'NetUnjoinDomain', 'NetUnregisterDomainNameChangeNotification', 'NetUseAdd', 'NetUseDel', 'NetUseEnum', 'NetUseGetInfo', 'NetUserAdd', 'NetUserChangePassword', 'NetUserDel', 'NetUserEnum', 'NetUserGetGroups', 'NetUserGetInfo', 'NetUserGetLocalGroups', 'NetUserModalsGet', 'NetUserModalsSet', 'NetUserSetGroups', 'NetUserSetInfo', 'NetValidateName', 'NetValidatePasswordPolicy', 'NetValidatePasswordPolicyFree', 'NetWkstaGetInfo', 'NetWkstaSetInfo', 'NetWkstaTransportAdd', 'NetWkstaTransportDel', 'NetWkstaTransportEnum', 'NetWkstaUserEnum', 'NetWkstaUserGetInfo', 'NetWkstaUserSetInfo', 'NetapipBufferAllocate', 'Netbios', 'NetpAddTlnFtinfoEntry', 'NetpAllocFtinfoEntry', 'NetpAssertFailed', 'NetpCleanFtinfoContext', 'NetpCloseConfigData', 'NetpCopyFtinfoContext', 'NetpDbgPrint', 'NetpGetConfigBool', 'NetpGetConfigDword', 'NetpGetConfigTStrArray', 'NetpGetConfigValue', 'NetpGetFileSecurity', 'NetpHexDump', 'NetpInitFtinfoContext', 'NetpIsRemote', 'NetpIsUncComputerNameValid', 'NetpMergeFtinfo', 'NetpNetBiosReset', 'NetpNetBiosStatusToApiStatus', 'NetpOpenConfigData', 'NetpSetFileSecurity', 'NetpwNameCanonicalize', 'NetpwNameCompare', 'NetpwNameValidate', 'NetpwPathCanonicalize', 'NetpwPathCompare', 'NetpwPathType', 'NlBindingAddServerToCache', 'NlBindingRemoveServerFromCache', 'NlBindingSetAuthInfo', 'RxNetAccessAdd', 'RxNetAccessDel', 'RxNetAccessEnum', 'RxNetAccessGetInfo', 'RxNetAccessGetUserPerms', 'RxNetAccessSetInfo', 'RxNetServerEnum', 'RxNetUserPasswordSet', 'RxRemoteApi', 'A_SHAFinal', 'A_SHAInit', 'A_SHAUpdate', 'AbortSystemShutdownA', 'AbortSystemShutdownW', 'AccessCheck', 'AccessCheckAndAuditAlarmA', 'AccessCheckAndAuditAlarmW', 'AccessCheckByType', 'AccessCheckByTypeAndAuditAlarmA', 'AccessCheckByTypeAndAuditAlarmW', 'AccessCheckByTypeResultList', 'AccessCheckByTypeResultListAndAuditAlarmA', 'AccessCheckByTypeResultListAndAuditAlarmByHandleA', 'AccessCheckByTypeResultListAndAuditAlarmByHandleW', 'AccessCheckByTypeResultListAndAuditAlarmW', 'AddAccessAllowedAce', 'AddAccessAllowedAceEx', 'AddAccessAllowedObjectAce', 'AddAccessDeniedAce', 'AddAccessDeniedAceEx', 'AddAccessDeniedObjectAce', 'AddAce', 'AddAuditAccessAce', 'AddAuditAccessAceEx', 'AddAuditAccessObjectAce', 'AddConditionalAce', 'AddMandatoryAce', 'AddUsersToEncryptedFile', 'AddUsersToEncryptedFileEx', 'AdjustTokenGroups', 'AdjustTokenPrivileges', 'AllocateAndInitializeSid', 'AllocateLocallyUniqueId', 'AreAllAccessesGranted', 'AreAnyAccessesGranted', 'AuditComputeEffectivePolicyBySid', 'AuditComputeEffectivePolicyByToken', 'AuditEnumerateCategories', 'AuditEnumeratePerUserPolicy', 'AuditEnumerateSubCategories', 'AuditFree', 'AuditLookupCategoryGuidFromCategoryId', 'AuditLookupCategoryIdFromCategoryGuid', 'AuditLookupCategoryNameA', 'AuditLookupCategoryNameW', 'AuditLookupSubCategoryNameA', 'AuditLookupSubCategoryNameW', 'AuditQueryGlobalSaclA', 'AuditQueryGlobalSaclW', 'AuditQueryPerUserPolicy', 'AuditQuerySecurity', 'AuditQuerySystemPolicy', 'AuditSetGlobalSaclA', 'AuditSetGlobalSaclW', 'AuditSetPerUserPolicy', 'AuditSetSecurity', 'AuditSetSystemPolicy', 'BackupEventLogA', 'BackupEventLogW', 'BaseRegCloseKey', 'BaseRegCreateKey', 'BaseRegDeleteKeyEx', 'BaseRegDeleteValue', 'BaseRegFlushKey', 'BaseRegGetVersion', 'BaseRegLoadKey', 'BaseRegOpenKey', 'BaseRegRestoreKey', 'BaseRegSaveKeyEx', 'BaseRegSetKeySecurity', 'BaseRegSetValue', 'BaseRegUnLoadKey', 'BuildExplicitAccessWithNameA', 'BuildExplicitAccessWithNameW', 'BuildImpersonateExplicitAccessWithNameA', 'BuildImpersonateExplicitAccessWithNameW', 'BuildImpersonateTrusteeA', 'BuildImpersonateTrusteeW', 'BuildSecurityDescriptorA', 'BuildSecurityDescriptorW', 'BuildTrusteeWithNameA', 'BuildTrusteeWithNameW', 'BuildTrusteeWithObjectsAndNameA', 'BuildTrusteeWithObjectsAndNameW', 'BuildTrusteeWithObjectsAndSidA', 'BuildTrusteeWithObjectsAndSidW', 'BuildTrusteeWithSidA', 'BuildTrusteeWithSidW', 'CancelOverlappedAccess', 'ChangeServiceConfig2A', 'ChangeServiceConfig2W', 'ChangeServiceConfigA', 'ChangeServiceConfigW', 'CheckForHiberboot', 'CheckTokenMembership', 'ClearEventLogA', 'ClearEventLogW', 'CloseCodeAuthzLevel', 'CloseEncryptedFileRaw', 'CloseEventLog', 'CloseServiceHandle', 'CloseThreadWaitChainSession', 'CloseTrace', 'CommandLineFromMsiDescriptor', 'ComputeAccessTokenFromCodeAuthzLevel', 'ControlService', 'ControlServiceExA', 'ControlServiceExW', 'ControlTraceA', 'ControlTraceW', 'ConvertAccessToSecurityDescriptorA', 'ConvertAccessToSecurityDescriptorW', 'ConvertSDToStringSDDomainW', 'ConvertSDToStringSDRootDomainA', 'ConvertSDToStringSDRootDomainW', 'ConvertSecurityDescriptorToAccessA', 'ConvertSecurityDescriptorToAccessNamedA', 'ConvertSecurityDescriptorToAccessNamedW', 'ConvertSecurityDescriptorToAccessW', 'ConvertSecurityDescriptorToStringSecurityDescriptorA', 'ConvertSecurityDescriptorToStringSecurityDescriptorW', 'ConvertSidToStringSidA', 'ConvertSidToStringSidW', 'ConvertStringSDToSDDomainA', 'ConvertStringSDToSDDomainW', 'ConvertStringSDToSDRootDomainA', 'ConvertStringSDToSDRootDomainW', 'ConvertStringSecurityDescriptorToSecurityDescriptorA', 'ConvertStringSecurityDescriptorToSecurityDescriptorW', 'ConvertStringSidToSidA', 'ConvertStringSidToSidW', 'ConvertToAutoInheritPrivateObjectSecurity', 'CopySid', 'CreateCodeAuthzLevel', 'CreatePrivateObjectSecurity', 'CreatePrivateObjectSecurityEx', 'CreatePrivateObjectSecurityWithMultipleInheritance', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'CreateProcessWithLogonW', 'CreateProcessWithTokenW', 'CreateRestrictedToken', 'CreateServiceA', 'CreateServiceEx', 'CreateServiceW', 'CreateTraceInstanceId', 'CreateWellKnownSid', 'CredBackupCredentials', 'CredDeleteA', 'CredDeleteW', 'CredEncryptAndMarshalBinaryBlob', 'CredEnumerateA', 'CredEnumerateW', 'CredFindBestCredentialA', 'CredFindBestCredentialW', 'CredFree', 'CredGetSessionTypes', 'CredGetTargetInfoA', 'CredGetTargetInfoW', 'CredIsMarshaledCredentialA', 'CredIsMarshaledCredentialW', 'CredIsProtectedA', 'CredIsProtectedW', 'CredMarshalCredentialA', 'CredMarshalCredentialW', 'CredProfileLoaded', 'CredProfileLoadedEx', 'CredProfileUnloaded', 'CredProtectA', 'CredProtectW', 'CredReadA', 'CredReadByTokenHandle', 'CredReadDomainCredentialsA', 'CredReadDomainCredentialsW', 'CredReadW', 'CredRenameA', 'CredRenameW', 'CredRestoreCredentials', 'CredUnmarshalCredentialA', 'CredUnmarshalCredentialW', 'CredUnprotectA', 'CredUnprotectW', 'CredWriteA', 'CredWriteDomainCredentialsA', 'CredWriteDomainCredentialsW', 'CredWriteW', 'CredpConvertCredential', 'CredpConvertOneCredentialSize', 'CredpConvertTargetInfo', 'CredpDecodeCredential', 'CredpEncodeCredential', 'CredpEncodeSecret', 'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptContextAddRef', 'CryptCreateHash', 'CryptDecrypt', 'CryptDeriveKey', 'CryptDestroyHash', 'CryptDestroyKey', 'CryptDuplicateHash', 'CryptDuplicateKey', 'CryptEncrypt', 'CryptEnumProviderTypesA', 'CryptEnumProviderTypesW', 'CryptEnumProvidersA', 'CryptEnumProvidersW', 'CryptExportKey', 'CryptGenKey', 'CryptGenRandom', 'CryptGetDefaultProviderA', 'CryptGetDefaultProviderW', 'CryptGetHashParam', 'CryptGetKeyParam', 'CryptGetProvParam', 'CryptGetUserKey', 'CryptHashData', 'CryptHashSessionKey', 'CryptImportKey', 'CryptReleaseContext', 'CryptSetHashParam', 'CryptSetKeyParam', 'CryptSetProvParam', 'CryptSetProviderA', 'CryptSetProviderExA', 'CryptSetProviderExW', 'CryptSetProviderW', 'CryptSignHashA', 'CryptSignHashW', 'CryptVerifySignatureA', 'CryptVerifySignatureW', 'CveEventWrite', 'DecryptFileA', 'DecryptFileW', 'DeleteAce', 'DeleteService', 'DeregisterEventSource', 'DestroyPrivateObjectSecurity', 'DuplicateEncryptionInfoFile', 'DuplicateToken', 'DuplicateTokenEx', 'ElfBackupEventLogFileA', 'ElfBackupEventLogFileW', 'ElfChangeNotify', 'ElfClearEventLogFileA', 'ElfClearEventLogFileW', 'ElfCloseEventLog', 'ElfDeregisterEventSource', 'ElfFlushEventLog', 'ElfNumberOfRecords', 'ElfOldestRecord', 'ElfOpenBackupEventLogA', 'ElfOpenBackupEventLogW', 'ElfOpenEventLogA', 'ElfOpenEventLogW', 'ElfReadEventLogA', 'ElfReadEventLogW', 'ElfRegisterEventSourceA', 'ElfRegisterEventSourceW', 'ElfReportEventA', 'ElfReportEventAndSourceW', 'ElfReportEventW', 'EnableTrace', 'EnableTraceEx', 'EnableTraceEx2', 'EncryptFileA', 'EncryptFileW', 'EncryptedFileKeyInfo', 'EncryptionDisable', 'EnumDependentServicesA', 'EnumDependentServicesW', 'EnumDynamicTimeZoneInformation', 'EnumServiceGroupW', 'EnumServicesStatusA', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumServicesStatusW', 'EnumerateTraceGuids', 'EnumerateTraceGuidsEx', 'EqualDomainSid', 'EqualPrefixSid', 'EqualSid', 'EventAccessControl', 'EventAccessQuery', 'EventAccessRemove', 'EventActivityIdControl', 'EventEnabled', 'EventProviderEnabled', 'EventRegister', 'EventSetInformation', 'EventUnregister', 'EventWrite', 'EventWriteEndScenario', 'EventWriteEx', 'EventWriteStartScenario', 'EventWriteString', 'EventWriteTransfer', 'FileEncryptionStatusA', 'FileEncryptionStatusW', 'FindFirstFreeAce', 'FlushEfsCache', 'FlushTraceA', 'FlushTraceW', 'FreeEncryptedFileKeyInfo', 'FreeEncryptedFileMetadata', 'FreeEncryptionCertificateHashList', 'FreeInheritedFromArray', 'FreeSid', 'GetAccessPermissionsForObjectA', 'GetAccessPermissionsForObjectW', 'GetAce', 'GetAclInformation', 'GetAuditedPermissionsFromAclA', 'GetAuditedPermissionsFromAclW', 'GetCurrentHwProfileA', 'GetCurrentHwProfileW', 'GetDynamicTimeZoneInformationEffectiveYears', 'GetEffectiveRightsFromAclA', 'GetEffectiveRightsFromAclW', 'GetEncryptedFileMetadata', 'GetEventLogInformation', 'GetExplicitEntriesFromAclA', 'GetExplicitEntriesFromAclW', 'GetFileSecurityA', 'GetFileSecurityW', 'GetInformationCodeAuthzLevelW', 'GetInformationCodeAuthzPolicyW', 'GetInheritanceSourceA', 'GetInheritanceSourceW', 'GetKernelObjectSecurity', 'GetLengthSid', 'GetLocalManagedApplicationData', 'GetLocalManagedApplications', 'GetManagedApplicationCategories', 'GetManagedApplications', 'GetMultipleTrusteeA', 'GetMultipleTrusteeOperationA', 'GetMultipleTrusteeOperationW', 'GetMultipleTrusteeW', 'GetNamedSecurityInfoA', 'GetNamedSecurityInfoExA', 'GetNamedSecurityInfoExW', 'GetNamedSecurityInfoW', 'GetNumberOfEventLogRecords', 'GetOldestEventLogRecord', 'GetOverlappedAccessResults', 'GetPrivateObjectSecurity', 'GetSecurityDescriptorControl', 'GetSecurityDescriptorDacl', 'GetSecurityDescriptorGroup', 'GetSecurityDescriptorLength', 'GetSecurityDescriptorOwner', 'GetSecurityDescriptorRMControl', 'GetSecurityDescriptorSacl', 'GetSecurityInfo', 'GetSecurityInfoExA', 'GetSecurityInfoExW', 'GetServiceDisplayNameA', 'GetServiceDisplayNameW', 'GetServiceKeyNameA', 'GetServiceKeyNameW', 'GetSidIdentifierAuthority', 'GetSidLengthRequired', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'GetStringConditionFromBinary', 'GetThreadWaitChain', 'GetTokenInformation', 'GetTraceEnableFlags', 'GetTraceEnableLevel', 'GetTraceLoggerHandle', 'GetTrusteeFormA', 'GetTrusteeFormW', 'GetTrusteeNameA', 'GetTrusteeNameW', 'GetTrusteeTypeA', 'GetTrusteeTypeW', 'GetUserNameA', 'GetUserNameW', 'GetWindowsAccountDomainSid', 'I_QueryTagInformation', 'I_ScGetCurrentGroupStateW', 'I_ScIsSecurityProcess', 'I_ScPnPGetServiceName', 'I_ScQueryServiceConfig', 'I_ScRegisterPreshutdownRestart', 'I_ScReparseServiceDatabase', 'I_ScSendPnPMessage', 'I_ScSendTSMessage', 'I_ScSetServiceBitsA', 'I_ScSetServiceBitsW', 'I_ScValidatePnPService', 'IdentifyCodeAuthzLevelW', 'ImpersonateAnonymousToken', 'ImpersonateLoggedOnUser', 'ImpersonateNamedPipeClient', 'ImpersonateSelf', 'InitializeAcl', 'InitializeSecurityDescriptor', 'InitializeSid', 'InitiateShutdownA', 'InitiateShutdownW', 'InitiateSystemShutdownA', 'InitiateSystemShutdownExA', 'InitiateSystemShutdownExW', 'InitiateSystemShutdownW', 'InstallApplication', 'IsTextUnicode', 'IsTokenRestricted', 'IsTokenUntrusted', 'IsValidAcl', 'IsValidRelativeSecurityDescriptor', 'IsValidSecurityDescriptor', 'IsValidSid', 'IsWellKnownSid', 'LockServiceDatabase', 'LogonUserA', 'LogonUserExA', 'LogonUserExExW', 'LogonUserExW', 'LogonUserW', 'LookupAccountNameA', 'LookupAccountNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'LookupPrivilegeDisplayNameA', 'LookupPrivilegeDisplayNameW', 'LookupPrivilegeNameA', 'LookupPrivilegeNameW', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'LookupSecurityDescriptorPartsA', 'LookupSecurityDescriptorPartsW', 'LsaAddAccountRights', 'LsaAddPrivilegesToAccount', 'LsaClearAuditLog', 'LsaClose', 'LsaCreateAccount', 'LsaCreateSecret', 'LsaCreateTrustedDomain', 'LsaCreateTrustedDomainEx', 'LsaDelete', 'LsaDeleteTrustedDomain', 'LsaEnumerateAccountRights', 'LsaEnumerateAccounts', 'LsaEnumerateAccountsWithUserRight', 'LsaEnumeratePrivileges', 'LsaEnumeratePrivilegesOfAccount', 'LsaEnumerateTrustedDomains', 'LsaEnumerateTrustedDomainsEx', 'LsaFreeMemory', 'LsaGetAppliedCAPIDs', 'LsaGetQuotasForAccount', 'LsaGetRemoteUserName', 'LsaGetSystemAccessAccount', 'LsaGetUserName', 'LsaICLookupNames', 'LsaICLookupNamesWithCreds', 'LsaICLookupSids', 'LsaICLookupSidsWithCreds', 'LsaLookupNames', 'LsaLookupNames2', 'LsaLookupPrivilegeDisplayName', 'LsaLookupPrivilegeName', 'LsaLookupPrivilegeValue', 'LsaLookupSids', 'LsaLookupSids2', 'LsaManageSidNameMapping', 'LsaNtStatusToWinError', 'LsaOpenAccount', 'LsaOpenPolicy', 'LsaOpenPolicySce', 'LsaOpenSecret', 'LsaOpenTrustedDomain', 'LsaOpenTrustedDomainByName', 'LsaQueryCAPs', 'LsaQueryDomainInformationPolicy', 'LsaQueryForestTrustInformation', 'LsaQueryInfoTrustedDomain', 'LsaQueryInformationPolicy', 'LsaQuerySecret', 'LsaQuerySecurityObject', 'LsaQueryTrustedDomainInfo', 'LsaQueryTrustedDomainInfoByName', 'LsaRemoveAccountRights', 'LsaRemovePrivilegesFromAccount', 'LsaRetrievePrivateData', 'LsaSetCAPs', 'LsaSetDomainInformationPolicy', 'LsaSetForestTrustInformation', 'LsaSetInformationPolicy', 'LsaSetInformationTrustedDomain', 'LsaSetQuotasForAccount', 'LsaSetSecret', 'LsaSetSecurityObject', 'LsaSetSystemAccessAccount', 'LsaSetTrustedDomainInfoByName', 'LsaSetTrustedDomainInformation', 'LsaStorePrivateData', 'MD4Final', 'MD4Init', 'MD4Update', 'MD5Final', 'MD5Init', 'MD5Update', 'MIDL_user_free_Ext', 'MSChapSrvChangePassword', 'MSChapSrvChangePassword2', 'MakeAbsoluteSD', 'MakeAbsoluteSD2', 'MakeSelfRelativeSD', 'MapGenericMask', 'NotifyBootConfigStatus', 'NotifyChangeEventLog', 'NotifyServiceStatusChange', 'NotifyServiceStatusChangeA', 'NotifyServiceStatusChangeW', 'NpGetUserName', 'ObjectCloseAuditAlarmA', 'ObjectCloseAuditAlarmW', 'ObjectDeleteAuditAlarmA', 'ObjectDeleteAuditAlarmW', 'ObjectOpenAuditAlarmA', 'ObjectOpenAuditAlarmW', 'ObjectPrivilegeAuditAlarmA', 'ObjectPrivilegeAuditAlarmW', 'OpenBackupEventLogA', 'OpenBackupEventLogW', 'OpenEncryptedFileRawA', 'OpenEncryptedFileRawW', 'OpenEventLogA', 'OpenEventLogW', 'OpenProcessToken', 'OpenSCManagerA', 'OpenSCManagerW', 'OpenServiceA', 'OpenServiceW', 'OpenThreadToken', 'OpenThreadWaitChainSession', 'OpenTraceA', 'OpenTraceW', 'OperationEnd', 'OperationStart', 'PerfAddCounters', 'PerfCloseQueryHandle', 'PerfCreateInstance', 'PerfDecrementULongCounterValue', 'PerfDecrementULongLongCounterValue', 'PerfDeleteCounters', 'PerfDeleteInstance', 'PerfEnumerateCounterSet', 'PerfEnumerateCounterSetInstances', 'PerfIncrementULongCounterValue', 'PerfIncrementULongLongCounterValue', 'PerfOpenQueryHandle', 'PerfQueryCounterData', 'PerfQueryCounterInfo', 'PerfQueryCounterSetRegistrationInfo', 'PerfQueryInstance', 'PerfRegCloseKey', 'PerfRegEnumKey', 'PerfRegEnumValue', 'PerfRegQueryInfoKey', 'PerfRegQueryValue', 'PerfRegSetValue', 'PerfSetCounterRefValue', 'PerfSetCounterSetInfo', 'PerfSetULongCounterValue', 'PerfSetULongLongCounterValue', 'PerfStartProvider', 'PerfStartProviderEx', 'PerfStopProvider', 'PrivilegeCheck', 'PrivilegedServiceAuditAlarmA', 'PrivilegedServiceAuditAlarmW', 'ProcessIdleTasks', 'ProcessIdleTasksW', 'ProcessTrace', 'QueryAllTracesA', 'QueryAllTracesW', 'QueryLocalUserServiceName', 'QueryRecoveryAgentsOnEncryptedFile', 'QuerySecurityAccessMask', 'QueryServiceConfig2A', 'QueryServiceConfig2W', 'QueryServiceConfigA', 'QueryServiceConfigW', 'QueryServiceDynamicInformation', 'QueryServiceLockStatusA', 'QueryServiceLockStatusW', 'QueryServiceObjectSecurity', 'QueryServiceStatus', 'QueryServiceStatusEx', 'QueryTraceA', 'QueryTraceProcessingHandle', 'QueryTraceW', 'QueryUserServiceName', 'QueryUserServiceNameForContext', 'QueryUsersOnEncryptedFile', 'ReadEncryptedFileRaw', 'ReadEventLogA', 'ReadEventLogW', 'RegCloseKey', 'RegConnectRegistryA', 'RegConnectRegistryExA', 'RegConnectRegistryExW', 'RegConnectRegistryW', 'RegCopyTreeA', 'RegCopyTreeW', 'RegCreateKeyA', 'RegCreateKeyExA', 'RegCreateKeyExW', 'RegCreateKeyTransactedA', 'RegCreateKeyTransactedW', 'RegCreateKeyW', 'RegDeleteKeyA', 'RegDeleteKeyExA', 'RegDeleteKeyExW', 'RegDeleteKeyTransactedA', 'RegDeleteKeyTransactedW', 'RegDeleteKeyValueA', 'RegDeleteKeyValueW', 'RegDeleteKeyW', 'RegDeleteTreeA', 'RegDeleteTreeW', 'RegDeleteValueA', 'RegDeleteValueW', 'RegDisablePredefinedCache', 'RegDisablePredefinedCacheEx', 'RegDisableReflectionKey', 'RegEnableReflectionKey', 'RegEnumKeyA', 'RegEnumKeyExA', 'RegEnumKeyExW', 'RegEnumKeyW', 'RegEnumValueA', 'RegEnumValueW', 'RegFlushKey', 'RegGetKeySecurity', 'RegGetValueA', 'RegGetValueW', 'RegLoadAppKeyA', 'RegLoadAppKeyW', 'RegLoadKeyA', 'RegLoadKeyW', 'RegLoadMUIStringA', 'RegLoadMUIStringW', 'RegNotifyChangeKeyValue', 'RegOpenCurrentUser', 'RegOpenKeyA', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegOpenKeyTransactedA', 'RegOpenKeyTransactedW', 'RegOpenKeyW', 'RegOpenUserClassesRoot', 'RegOverridePredefKey', 'RegQueryInfoKeyA', 'RegQueryInfoKeyW', 'RegQueryMultipleValuesA', 'RegQueryMultipleValuesW', 'RegQueryReflectionKey', 'RegQueryValueA', 'RegQueryValueExA', 'RegQueryValueExW', 'RegQueryValueW', 'RegRenameKey', 'RegReplaceKeyA', 'RegReplaceKeyW', 'RegRestoreKeyA', 'RegRestoreKeyW', 'RegSaveKeyA', 'RegSaveKeyExA', 'RegSaveKeyExW', 'RegSaveKeyW', 'RegSetKeySecurity', 'RegSetKeyValueA', 'RegSetKeyValueW', 'RegSetValueA', 'RegSetValueExA', 'RegSetValueExW', 'RegSetValueW', 'RegUnLoadKeyA', 'RegUnLoadKeyW', 'RegisterEventSourceA', 'RegisterEventSourceW', 'RegisterIdleTask', 'RegisterServiceCtrlHandlerA', 'RegisterServiceCtrlHandlerExA', 'RegisterServiceCtrlHandlerExW', 'RegisterServiceCtrlHandlerW', 'RegisterTraceGuidsA', 'RegisterTraceGuidsW', 'RegisterWaitChainCOMCallback', 'RemoteRegEnumKeyWrapper', 'RemoteRegEnumValueWrapper', 'RemoteRegQueryInfoKeyWrapper', 'RemoteRegQueryMultipleValues2Wrapper', 'RemoteRegQueryMultipleValuesWrapper', 'RemoteRegQueryValueWrapper', 'RemoveTraceCallback', 'RemoveUsersFromEncryptedFile', 'ReportEventA', 'ReportEventW', 'RevertToSelf', 'SafeBaseRegGetKeySecurity', 'SaferCloseLevel', 'SaferComputeTokenFromLevel', 'SaferCreateLevel', 'SaferGetLevelInformation', 'SaferGetPolicyInformation', 'SaferIdentifyLevel', 'SaferRecordEventLogEntry', 'SaferSetLevelInformation', 'SaferSetPolicyInformation', 'SaferiChangeRegistryScope', 'SaferiCompareTokenLevels', 'SaferiIsDllAllowed', 'SaferiIsExecutableFileType', 'SaferiPopulateDefaultsInRegistry', 'SaferiRecordEventLogEntry', 'SaferiSearchMatchingHashRules', 'SetAclInformation', 'SetEncryptedFileMetadata', 'SetEntriesInAccessListA', 'SetEntriesInAccessListW', 'SetEntriesInAclA', 'SetEntriesInAclW', 'SetEntriesInAuditListA', 'SetEntriesInAuditListW', 'SetFileSecurityA', 'SetFileSecurityW', 'SetInformationCodeAuthzLevelW', 'SetInformationCodeAuthzPolicyW', 'SetKernelObjectSecurity', 'SetNamedSecurityInfoA', 'SetNamedSecurityInfoExA', 'SetNamedSecurityInfoExW', 'SetNamedSecurityInfoW', 'SetPrivateObjectSecurity', 'SetPrivateObjectSecurityEx', 'SetSecurityAccessMask', 'SetSecurityDescriptorControl', 'SetSecurityDescriptorDacl', 'SetSecurityDescriptorGroup', 'SetSecurityDescriptorOwner', 'SetSecurityDescriptorRMControl', 'SetSecurityDescriptorSacl', 'SetSecurityInfo', 'SetSecurityInfoExA', 'SetSecurityInfoExW', 'SetServiceBits', 'SetServiceObjectSecurity', 'SetServiceStatus', 'SetThreadToken', 'SetTokenInformation', 'SetTraceCallback', 'SetUserFileEncryptionKey', 'SetUserFileEncryptionKeyEx', 'StartServiceA', 'StartServiceCtrlDispatcherA', 'StartServiceCtrlDispatcherW', 'StartServiceW', 'StartTraceA', 'StartTraceW', 'StopTraceA', 'StopTraceW', 'SystemFunction001', 'SystemFunction002', 'SystemFunction003', 'SystemFunction004', 'SystemFunction005', 'SystemFunction006', 'SystemFunction007', 'SystemFunction008', 'SystemFunction009', 'SystemFunction010', 'SystemFunction011', 'SystemFunction012', 'SystemFunction013', 'SystemFunction014', 'SystemFunction015', 'SystemFunction016', 'SystemFunction017', 'SystemFunction018', 'SystemFunction019', 'SystemFunction020', 'SystemFunction021', 'SystemFunction022', 'SystemFunction023', 'SystemFunction024', 'SystemFunction025', 'SystemFunction026', 'SystemFunction027', 'SystemFunction028', 'SystemFunction029', 'SystemFunction030', 'SystemFunction031', 'SystemFunction032', 'SystemFunction033', 'SystemFunction034', 'SystemFunction035', 'SystemFunction036', 'SystemFunction040', 'SystemFunction041', 'TraceEvent', 'TraceEventInstance', 'TraceMessage', 'TraceMessageVa', 'TraceQueryInformation', 'TraceSetInformation', 'TreeResetNamedSecurityInfoA', 'TreeResetNamedSecurityInfoW', 'TreeSetNamedSecurityInfoA', 'TreeSetNamedSecurityInfoW', 'TrusteeAccessToObjectA', 'TrusteeAccessToObjectW', 'UninstallApplication', 'UnlockServiceDatabase', 'UnregisterIdleTask', 'UnregisterTraceGuids', 'UpdateTraceA', 'UpdateTraceW', 'UsePinForEncryptedFilesA', 'UsePinForEncryptedFilesW', 'WaitServiceState', 'WmiCloseBlock', 'WmiDevInstToInstanceNameA', 'WmiDevInstToInstanceNameW', 'WmiEnumerateGuids', 'WmiExecuteMethodA', 'WmiExecuteMethodW', 'WmiFileHandleToInstanceNameA', 'WmiFileHandleToInstanceNameW', 'WmiFreeBuffer', 'WmiMofEnumerateResourcesA', 'WmiMofEnumerateResourcesW', 'WmiNotificationRegistrationA', 'WmiNotificationRegistrationW', 'WmiOpenBlock', 'WmiQueryAllDataA', 'WmiQueryAllDataMultipleA', 'WmiQueryAllDataMultipleW', 'WmiQueryAllDataW', 'WmiQueryGuidInformation', 'WmiQuerySingleInstanceA', 'WmiQuerySingleInstanceMultipleA', 'WmiQuerySingleInstanceMultipleW', 'WmiQuerySingleInstanceW', 'WmiReceiveNotificationsA', 'WmiReceiveNotificationsW', 'WmiSetSingleInstanceA', 'WmiSetSingleInstanceW', 'WmiSetSingleItemA', 'WmiSetSingleItemW', 'WriteEncryptedFileRaw', 'AbortDoc', 'AbortPath', 'AddFontMemResourceEx', 'AddFontResourceA', 'AddFontResourceExA', 'AddFontResourceExW', 'AddFontResourceTracking', 'AddFontResourceW', 'AngleArc', 'AnimatePalette', 'AnyLinkedFonts', 'Arc', 'ArcTo', 'BRUSHOBJ_hGetColorTransform', 'BRUSHOBJ_pvAllocRbrush', 'BRUSHOBJ_pvGetRbrush', 'BRUSHOBJ_ulGetBrushColor', 'BeginGdiRendering', 'BeginPath', 'BitBlt', 'CLIPOBJ_bEnum', 'CLIPOBJ_cEnumStart', 'CLIPOBJ_ppoGetPath', 'CancelDC', 'CheckColorsInGamut', 'ChoosePixelFormat', 'Chord', 'ClearBitmapAttributes', 'ClearBrushAttributes', 'CloseEnhMetaFile', 'CloseFigure', 'CloseMetaFile', 'ColorCorrectPalette', 'ColorMatchToTarget', 'CombineRgn', 'CombineTransform', 'ConfigureOPMProtectedOutput', 'CopyEnhMetaFileA', 'CopyEnhMetaFileW', 'CopyMetaFileA', 'CopyMetaFileW', 'CreateBitmap', 'CreateBitmapFromDxSurface', 'CreateBitmapFromDxSurface2', 'CreateBitmapIndirect', 'CreateBrushIndirect', 'CreateColorSpaceA', 'CreateColorSpaceW', 'CreateCompatibleBitmap', 'CreateCompatibleDC', 'CreateDCA', 'CreateDCExW', 'CreateDCW', 'CreateDIBPatternBrush', 'CreateDIBPatternBrushPt', 'CreateDIBSection', 'CreateDIBitmap', 'CreateDPIScaledDIBSection', 'CreateDiscardableBitmap', 'CreateEllipticRgn', 'CreateEllipticRgnIndirect', 'CreateEnhMetaFileA', 'CreateEnhMetaFileW', 'CreateFontA', 'CreateFontIndirectA', 'CreateFontIndirectExA', 'CreateFontIndirectExW', 'CreateFontIndirectW', 'CreateFontW', 'CreateHalftonePalette', 'CreateHatchBrush', 'CreateICA', 'CreateICW', 'CreateMetaFileA', 'CreateMetaFileW', 'CreateOPMProtectedOutput', 'CreateOPMProtectedOutputs', 'CreatePalette', 'CreatePatternBrush', 'CreatePen', 'CreatePenIndirect', 'CreatePolyPolygonRgn', 'CreatePolygonRgn', 'CreateRectRgn', 'CreateRectRgnIndirect', 'CreateRoundRectRgn', 'CreateScalableFontResourceA', 'CreateScalableFontResourceW', 'CreateSessionMappedDIBSection', 'CreateSolidBrush', 'D3DKMTAbandonSwapChain', 'D3DKMTAcquireKeyedMutex', 'D3DKMTAcquireKeyedMutex2', 'D3DKMTAcquireSwapChain', 'D3DKMTAddSurfaceToSwapChain', 'D3DKMTAdjustFullscreenGamma', 'D3DKMTCacheHybridQueryValue', 'D3DKMTChangeVideoMemoryReservation', 'D3DKMTCheckExclusiveOwnership', 'D3DKMTCheckMonitorPowerState', 'D3DKMTCheckMultiPlaneOverlaySupport', 'D3DKMTCheckMultiPlaneOverlaySupport2', 'D3DKMTCheckMultiPlaneOverlaySupport3', 'D3DKMTCheckOcclusion', 'D3DKMTCheckSharedResourceAccess', 'D3DKMTCheckVidPnExclusiveOwnership', 'D3DKMTCloseAdapter', 'D3DKMTConfigureSharedResource', 'D3DKMTCreateAllocation', 'D3DKMTCreateAllocation2', 'D3DKMTCreateBundleObject', 'D3DKMTCreateContext', 'D3DKMTCreateContextVirtual', 'D3DKMTCreateDCFromMemory', 'D3DKMTCreateDevice', 'D3DKMTCreateHwContext', 'D3DKMTCreateHwQueue', 'D3DKMTCreateKeyedMutex', 'D3DKMTCreateKeyedMutex2', 'D3DKMTCreateOutputDupl', 'D3DKMTCreateOverlay', 'D3DKMTCreatePagingQueue', 'D3DKMTCreateProtectedSession', 'D3DKMTCreateSwapChain', 'D3DKMTCreateSynchronizationObject', 'D3DKMTCreateSynchronizationObject2', 'D3DKMTCreateTrackedWorkload', 'D3DKMTDDisplayEnum', 'D3DKMTDestroyAllocation', 'D3DKMTDestroyAllocation2', 'D3DKMTDestroyContext', 'D3DKMTDestroyDCFromMemory', 'D3DKMTDestroyDevice', 'D3DKMTDestroyHwContext', 'D3DKMTDestroyHwQueue', 'D3DKMTDestroyKeyedMutex', 'D3DKMTDestroyOutputDupl', 'D3DKMTDestroyOverlay', 'D3DKMTDestroyPagingQueue', 'D3DKMTDestroyProtectedSession', 'D3DKMTDestroySynchronizationObject', 'D3DKMTDestroyTrackedWorkload', 'D3DKMTDispMgrCreate', 'D3DKMTDispMgrSourceOperation', 'D3DKMTDispMgrTargetOperation', 'D3DKMTEndTrackedWorkload', 'D3DKMTEnumAdapters', 'D3DKMTEnumAdapters2', 'D3DKMTEscape', 'D3DKMTEvict', 'D3DKMTExtractBundleObject', 'D3DKMTFlipOverlay', 'D3DKMTFlushHeapTransitions', 'D3DKMTFreeGpuVirtualAddress', 'D3DKMTGetAllocationPriority', 'D3DKMTGetAvailableTrackedWorkloadIndex', 'D3DKMTGetCachedHybridQueryValue', 'D3DKMTGetContextInProcessSchedulingPriority', 'D3DKMTGetContextSchedulingPriority', 'D3DKMTGetDWMVerticalBlankEvent', 'D3DKMTGetDeviceState', 'D3DKMTGetDisplayModeList', 'D3DKMTGetMemoryBudgetTarget', 'D3DKMTGetMultiPlaneOverlayCaps', 'D3DKMTGetMultisampleMethodList', 'D3DKMTGetOverlayState', 'D3DKMTGetPostCompositionCaps', 'D3DKMTGetPresentHistory', 'D3DKMTGetPresentQueueEvent', 'D3DKMTGetProcessDeviceRemovalSupport', 'D3DKMTGetProcessList', 'D3DKMTGetProcessSchedulingPriorityBand', 'D3DKMTGetProcessSchedulingPriorityClass', 'D3DKMTGetResourcePresentPrivateDriverData', 'D3DKMTGetRuntimeData', 'D3DKMTGetScanLine', 'D3DKMTGetSetSwapChainMetadata', 'D3DKMTGetSharedPrimaryHandle', 'D3DKMTGetSharedResourceAdapterLuid', 'D3DKMTGetTrackedWorkloadStatistics', 'D3DKMTGetYieldPercentage', 'D3DKMTInvalidateActiveVidPn', 'D3DKMTInvalidateCache', 'D3DKMTLock', 'D3DKMTLock2', 'D3DKMTMakeResident', 'D3DKMTMapGpuVirtualAddress', 'D3DKMTMarkDeviceAsError', 'D3DKMTNetDispGetNextChunkInfo', 'D3DKMTNetDispQueryMiracastDisplayDeviceStatus', 'D3DKMTNetDispQueryMiracastDisplayDeviceSupport', 'D3DKMTNetDispStartMiracastDisplayDevice', 'D3DKMTNetDispStartMiracastDisplayDevice2', 'D3DKMTNetDispStartMiracastDisplayDeviceEx', 'D3DKMTNetDispStopMiracastDisplayDevice', 'D3DKMTNetDispStopSessions', 'D3DKMTOfferAllocations', 'D3DKMTOpenAdapterFromDeviceName', 'D3DKMTOpenAdapterFromGdiDisplayName', 'D3DKMTOpenAdapterFromHdc', 'D3DKMTOpenAdapterFromLuid', 'D3DKMTOpenBundleObjectNtHandleFromName', 'D3DKMTOpenKeyedMutex', 'D3DKMTOpenKeyedMutex2', 'D3DKMTOpenKeyedMutexFromNtHandle', 'D3DKMTOpenNtHandleFromName', 'D3DKMTOpenProtectedSessionFromNtHandle', 'D3DKMTOpenResource', 'D3DKMTOpenResource2', 'D3DKMTOpenResourceFromNtHandle', 'D3DKMTOpenSwapChain', 'D3DKMTOpenSyncObjectFromNtHandle', 'D3DKMTOpenSyncObjectFromNtHandle2', 'D3DKMTOpenSyncObjectNtHandleFromName', 'D3DKMTOpenSynchronizationObject', 'D3DKMTOutputDuplGetFrameInfo', 'D3DKMTOutputDuplGetMetaData', 'D3DKMTOutputDuplGetPointerShapeData', 'D3DKMTOutputDuplPresent', 'D3DKMTOutputDuplReleaseFrame', 'D3DKMTPinDirectFlipResources', 'D3DKMTPollDisplayChildren', 'D3DKMTPresent', 'D3DKMTPresentMultiPlaneOverlay', 'D3DKMTPresentMultiPlaneOverlay2', 'D3DKMTPresentMultiPlaneOverlay3', 'D3DKMTPresentRedirected', 'D3DKMTQueryAdapterInfo', 'D3DKMTQueryAllocationResidency', 'D3DKMTQueryClockCalibration', 'D3DKMTQueryFSEBlock', 'D3DKMTQueryProcessOfferInfo', 'D3DKMTQueryProtectedSessionInfoFromNtHandle', 'D3DKMTQueryProtectedSessionStatus', 'D3DKMTQueryRemoteVidPnSourceFromGdiDisplayName', 'D3DKMTQueryResourceInfo', 'D3DKMTQueryResourceInfoFromNtHandle', 'D3DKMTQueryStatistics', 'D3DKMTQueryVidPnExclusiveOwnership', 'D3DKMTQueryVideoMemoryInfo', 'D3DKMTReclaimAllocations', 'D3DKMTReclaimAllocations2', 'D3DKMTRegisterTrimNotification', 'D3DKMTRegisterVailProcess', 'D3DKMTReleaseKeyedMutex', 'D3DKMTReleaseKeyedMutex2', 'D3DKMTReleaseProcessVidPnSourceOwners', 'D3DKMTReleaseSwapChain', 'D3DKMTRemoveSurfaceFromSwapChain', 'D3DKMTRender', 'D3DKMTReserveGpuVirtualAddress', 'D3DKMTResetTrackedWorkload', 'D3DKMTSetAllocationPriority', 'D3DKMTSetContextInProcessSchedulingPriority', 'D3DKMTSetContextSchedulingPriority', 'D3DKMTSetDisplayMode', 'D3DKMTSetDisplayPrivateDriverFormat', 'D3DKMTSetDodIndirectSwapchain', 'D3DKMTSetFSEBlock', 'D3DKMTSetGammaRamp', 'D3DKMTSetHwProtectionTeardownRecovery', 'D3DKMTSetMemoryBudgetTarget', 'D3DKMTSetMonitorColorSpaceTransform', 'D3DKMTSetProcessDeviceRemovalSupport', 'D3DKMTSetProcessSchedulingPriorityBand', 'D3DKMTSetProcessSchedulingPriorityClass', 'D3DKMTSetQueuedLimit', 'D3DKMTSetStablePowerState', 'D3DKMTSetStereoEnabled', 'D3DKMTSetSyncRefreshCountWaitTarget', 'D3DKMTSetVidPnSourceHwProtection', 'D3DKMTSetVidPnSourceOwner', 'D3DKMTSetVidPnSourceOwner1', 'D3DKMTSetVidPnSourceOwner2', 'D3DKMTSetYieldPercentage', 'D3DKMTShareObjects', 'D3DKMTSharedPrimaryLockNotification', 'D3DKMTSharedPrimaryUnLockNotification', 'D3DKMTSignalSynchronizationObject', 'D3DKMTSignalSynchronizationObject2', 'D3DKMTSignalSynchronizationObjectFromCpu', 'D3DKMTSignalSynchronizationObjectFromGpu', 'D3DKMTSignalSynchronizationObjectFromGpu2', 'D3DKMTSubmitCommand', 'D3DKMTSubmitCommandToHwQueue', 'D3DKMTSubmitPresentBltToHwQueue', 'D3DKMTSubmitPresentToHwQueue', 'D3DKMTSubmitSignalSyncObjectsToHwQueue', 'D3DKMTSubmitWaitForSyncObjectsToHwQueue', 'D3DKMTTrimProcessCommitment', 'D3DKMTUnOrderedPresentSwapChain', 'D3DKMTUnlock', 'D3DKMTUnlock2', 'D3DKMTUnpinDirectFlipResources', 'D3DKMTUnregisterTrimNotification', 'D3DKMTUpdateAllocationProperty', 'D3DKMTUpdateGpuVirtualAddress', 'D3DKMTUpdateOverlay', 'D3DKMTUpdateTrackedWorkload', 'D3DKMTVailConnect', 'D3DKMTVailDisconnect', 'D3DKMTVailPromoteCompositionSurface', 'D3DKMTWaitForIdle', 'D3DKMTWaitForSynchronizationObject', 'D3DKMTWaitForSynchronizationObject2', 'D3DKMTWaitForSynchronizationObjectFromCpu', 'D3DKMTWaitForSynchronizationObjectFromGpu', 'D3DKMTWaitForVerticalBlankEvent', 'D3DKMTWaitForVerticalBlankEvent2', 'DDCCIGetCapabilitiesString', 'DDCCIGetCapabilitiesStringLength', 'DDCCIGetTimingReport', 'DDCCIGetVCPFeature', 'DDCCISaveCurrentSettings', 'DDCCISetVCPFeature', 'DPtoLP', 'DdCreateFullscreenSprite', 'DdDestroyFullscreenSprite', 'DdEntry0', 'DdEntry1', 'DdEntry10', 'DdEntry11', 'DdEntry12', 'DdEntry13', 'DdEntry14', 'DdEntry15', 'DdEntry16', 'DdEntry17', 'DdEntry18', 'DdEntry19', 'DdEntry2', 'DdEntry20', 'DdEntry21', 'DdEntry22', 'DdEntry23', 'DdEntry24', 'DdEntry25', 'DdEntry26', 'DdEntry27', 'DdEntry28', 'DdEntry29', 'DdEntry3', 'DdEntry30', 'DdEntry31', 'DdEntry32', 'DdEntry33', 'DdEntry34', 'DdEntry35', 'DdEntry36', 'DdEntry37', 'DdEntry38', 'DdEntry39', 'DdEntry4', 'DdEntry40', 'DdEntry41', 'DdEntry42', 'DdEntry43', 'DdEntry44', 'DdEntry45', 'DdEntry46', 'DdEntry47', 'DdEntry48', 'DdEntry49', 'DdEntry5', 'DdEntry50', 'DdEntry51', 'DdEntry52', 'DdEntry53', 'DdEntry54', 'DdEntry55', 'DdEntry56', 'DdEntry6', 'DdEntry7', 'DdEntry8', 'DdEntry9', 'DdNotifyFullscreenSpriteUpdate', 'DdQueryVisRgnUniqueness', 'DeleteColorSpace', 'DeleteDC', 'DeleteEnhMetaFile', 'DeleteMetaFile', 'DeleteObject', 'DescribePixelFormat', 'DestroyOPMProtectedOutput', 'DestroyPhysicalMonitorInternal', 'DeviceCapabilitiesExA', 'DeviceCapabilitiesExW', 'DrawEscape', 'DwmCreatedBitmapRemotingOutput', 'DxTrimNotificationListHead', 'Ellipse', 'EnableEUDC', 'EndDoc', 'EndFormPage', 'EndGdiRendering', 'EndPage', 'EndPath', 'EngAcquireSemaphore', 'EngAlphaBlend', 'EngAssociateSurface', 'EngBitBlt', 'EngCheckAbort', 'EngComputeGlyphSet', 'EngCopyBits', 'EngCreateBitmap', 'EngCreateClip', 'EngCreateDeviceBitmap', 'EngCreateDeviceSurface', 'EngCreatePalette', 'EngCreateSemaphore', 'EngDeleteClip', 'EngDeletePalette', 'EngDeletePath', 'EngDeleteSemaphore', 'EngDeleteSurface', 'EngEraseSurface', 'EngFillPath', 'EngFindResource', 'EngFreeModule', 'EngGetCurrentCodePage', 'EngGetDriverName', 'EngGetPrinterDataFileName', 'EngGradientFill', 'EngLineTo', 'EngLoadModule', 'EngLockSurface', 'EngMarkBandingSurface', 'EngMultiByteToUnicodeN', 'EngMultiByteToWideChar', 'EngPaint', 'EngPlgBlt', 'EngQueryEMFInfo', 'EngQueryLocalTime', 'EngReleaseSemaphore', 'EngStretchBlt', 'EngStretchBltROP', 'EngStrokeAndFillPath', 'EngStrokePath', 'EngTextOut', 'EngTransparentBlt', 'EngUnicodeToMultiByteN', 'EngUnlockSurface', 'EngWideCharToMultiByte', 'EnumEnhMetaFile', 'EnumFontFamiliesA', 'EnumFontFamiliesExA', 'EnumFontFamiliesExW', 'EnumFontFamiliesW', 'EnumFontsA', 'EnumFontsW', 'EnumICMProfilesA', 'EnumICMProfilesW', 'EnumMetaFile', 'EnumObjects', 'EqualRgn', 'Escape', 'EudcLoadLinkW', 'EudcUnloadLinkW', 'ExcludeClipRect', 'ExtCreatePen', 'ExtCreateRegion', 'ExtEscape', 'ExtFloodFill', 'ExtSelectClipRgn', 'ExtTextOutA', 'ExtTextOutW', 'FONTOBJ_cGetAllGlyphHandles', 'FONTOBJ_cGetGlyphs', 'FONTOBJ_pQueryGlyphAttrs', 'FONTOBJ_pfdg', 'FONTOBJ_pifi', 'FONTOBJ_pvTrueTypeFontFile', 'FONTOBJ_pxoGetXform', 'FONTOBJ_vGetInfo', 'FillPath', 'FillRgn', 'FixBrushOrgEx', 'FlattenPath', 'FloodFill', 'FontIsLinked', 'FrameRgn', 'Gdi32DllInitialize', 'GdiAddFontResourceW', 'GdiAddGlsBounds', 'GdiAddGlsRecord', 'GdiAddInitialFonts', 'GdiAlphaBlend', 'GdiArtificialDecrementDriver', 'GdiBatchLimit', 'GdiCleanCacheDC', 'GdiComment', 'GdiConsoleTextOut', 'GdiConvertAndCheckDC', 'GdiConvertBitmap', 'GdiConvertBitmapV5', 'GdiConvertBrush', 'GdiConvertDC', 'GdiConvertEnhMetaFile', 'GdiConvertFont', 'GdiConvertMetaFilePict', 'GdiConvertPalette', 'GdiConvertRegion', 'GdiConvertToDevmodeW', 'GdiCreateLocalEnhMetaFile', 'GdiCreateLocalMetaFilePict', 'GdiCurrentProcessSplWow64', 'GdiDeleteLocalDC', 'GdiDeleteSpoolFileHandle', 'GdiDescribePixelFormat', 'GdiDllInitialize', 'GdiDrawStream', 'GdiEndDocEMF', 'GdiEndPageEMF', 'GdiEntry1', 'GdiEntry10', 'GdiEntry11', 'GdiEntry12', 'GdiEntry13', 'GdiEntry14', 'GdiEntry15', 'GdiEntry16', 'GdiEntry2', 'GdiEntry3', 'GdiEntry4', 'GdiEntry5', 'GdiEntry6', 'GdiEntry7', 'GdiEntry8', 'GdiEntry9', 'GdiFixUpHandle', 'GdiFlush', 'GdiFullscreenControl', 'GdiGetBatchLimit', 'GdiGetBitmapBitsSize', 'GdiGetCharDimensions', 'GdiGetCodePage', 'GdiGetDC', 'GdiGetDevmodeForPage', 'GdiGetEntry', 'GdiGetLocalBrush', 'GdiGetLocalDC', 'GdiGetLocalFont', 'GdiGetPageCount', 'GdiGetPageHandle', 'GdiGetSpoolFileHandle', 'GdiGetSpoolMessage', 'GdiGetVariationStoreDelta', 'GdiGradientFill', 'GdiInitSpool', 'GdiInitializeLanguagePack', 'GdiIsMetaFileDC', 'GdiIsMetaPrintDC', 'GdiIsPlayMetafileDC', 'GdiIsScreenDC', 'GdiIsTrackingEnabled', 'GdiIsUMPDSandboxingEnabled', 'GdiLoadType1Fonts', 'GdiPlayDCScript', 'GdiPlayEMF', 'GdiPlayJournal', 'GdiPlayPageEMF', 'GdiPlayPrivatePageEMF', 'GdiPlayScript', 'GdiPrinterThunk', 'GdiProcessSetup', 'GdiQueryFonts', 'GdiQueryTable', 'GdiRealizationInfo', 'GdiReleaseDC', 'GdiReleaseLocalDC', 'GdiResetDCEMF', 'GdiSetAttrs', 'GdiSetBatchLimit', 'GdiSetLastError', 'GdiSetPixelFormat', 'GdiSetServerAttr', 'GdiStartDocEMF', 'GdiStartPageEMF', 'GdiSupportsFontChangeEvent', 'GdiSwapBuffers', 'GdiTrackHCreate', 'GdiTrackHDelete', 'GdiTransparentBlt', 'GdiValidateHandle', 'GetArcDirection', 'GetAspectRatioFilterEx', 'GetBitmapAttributes', 'GetBitmapBits', 'GetBitmapDimensionEx', 'GetBitmapDpiScaleValue', 'GetBkColor', 'GetBkMode', 'GetBoundsRect', 'GetBrushAttributes', 'GetBrushOrgEx', 'GetCOPPCompatibleOPMInformation', 'GetCertificate', 'GetCertificateByHandle', 'GetCertificateSize', 'GetCertificateSizeByHandle', 'GetCharABCWidthsA', 'GetCharABCWidthsFloatA', 'GetCharABCWidthsFloatI', 'GetCharABCWidthsFloatW', 'GetCharABCWidthsI', 'GetCharABCWidthsW', 'GetCharWidth32A', 'GetCharWidth32W', 'GetCharWidthA', 'GetCharWidthFloatA', 'GetCharWidthFloatW', 'GetCharWidthI', 'GetCharWidthInfo', 'GetCharWidthW', 'GetCharacterPlacementA', 'GetCharacterPlacementW', 'GetClipBox', 'GetClipRgn', 'GetColorAdjustment', 'GetColorSpace', 'GetCurrentDpiInfo', 'GetCurrentObject', 'GetCurrentPositionEx', 'GetDCBrushColor', 'GetDCDpiScaleValue', 'GetDCOrgEx', 'GetDCPenColor', 'GetDIBColorTable', 'GetDIBits', 'GetDeviceCaps', 'GetDeviceGammaRamp', 'GetETM', 'GetEUDCTimeStamp', 'GetEUDCTimeStampExW', 'GetEnhMetaFileA', 'GetEnhMetaFileBits', 'GetEnhMetaFileDescriptionA', 'GetEnhMetaFileDescriptionW', 'GetEnhMetaFileHeader', 'GetEnhMetaFilePaletteEntries', 'GetEnhMetaFilePixelFormat', 'GetEnhMetaFileW', 'GetFontAssocStatus', 'GetFontData', 'GetFontFileData', 'GetFontFileInfo', 'GetFontLanguageInfo', 'GetFontRealizationInfo', 'GetFontResourceInfoW', 'GetFontUnicodeRanges', 'GetGlyphIndicesA', 'GetGlyphIndicesW', 'GetGlyphOutline', 'GetGlyphOutlineA', 'GetGlyphOutlineW', 'GetGlyphOutlineWow', 'GetGraphicsMode', 'GetHFONT', 'GetICMProfileA', 'GetICMProfileW', 'GetKerningPairs', 'GetKerningPairsA', 'GetKerningPairsW', 'GetLayout', 'GetLogColorSpaceA', 'GetLogColorSpaceW', 'GetMapMode', 'GetMetaFileA', 'GetMetaFileBitsEx', 'GetMetaFileW', 'GetMetaRgn', 'GetMiterLimit', 'GetNearestColor', 'GetNearestPaletteIndex', 'GetNumberOfPhysicalMonitors', 'GetOPMInformation', 'GetOPMRandomNumber', 'GetObjectA', 'GetObjectType', 'GetObjectW', 'GetOutlineTextMetricsA', 'GetOutlineTextMetricsW', 'GetPaletteEntries', 'GetPath', 'GetPhysicalMonitorDescription', 'GetPhysicalMonitors', 'GetPixel', 'GetPixelFormat', 'GetPolyFillMode', 'GetProcessSessionFonts', 'GetROP2', 'GetRandomRgn', 'GetRasterizerCaps', 'GetRegionData', 'GetRelAbs', 'GetRgnBox', 'GetStockObject', 'GetStretchBltMode', 'GetStringBitmapA', 'GetStringBitmapW', 'GetSuggestedOPMProtectedOutputArraySize', 'GetSystemPaletteEntries', 'GetSystemPaletteUse', 'GetTextAlign', 'GetTextCharacterExtra', 'GetTextCharset', 'GetTextCharsetInfo', 'GetTextColor', 'GetTextExtentExPointA', 'GetTextExtentExPointI', 'GetTextExtentExPointW', 'GetTextExtentExPointWPri', 'GetTextExtentPoint32A', 'GetTextExtentPoint32W', 'GetTextExtentPointA', 'GetTextExtentPointI', 'GetTextExtentPointW', 'GetTextFaceA', 'GetTextFaceAliasW', 'GetTextFaceW', 'GetTextMetricsA', 'GetTextMetricsW', 'GetTransform', 'GetViewportExtEx', 'GetViewportOrgEx', 'GetWinMetaFileBits', 'GetWindowExtEx', 'GetWindowOrgEx', 'GetWorldTransform', 'HT_Get8BPPFormatPalette', 'HT_Get8BPPMaskPalette', 'InternalDeleteDC', 'IntersectClipRect', 'InvertRgn', 'IsValidEnhMetaRecord', 'IsValidEnhMetaRecordOffExt', 'LPtoDP', 'LineDDA', 'LineTo', 'LpkDrawTextEx', 'LpkEditControl', 'LpkExtTextOut', 'LpkGetCharacterPlacement', 'LpkGetEditControl', 'LpkGetTextExtentExPoint', 'LpkInitialize', 'LpkPSMTextOut', 'LpkPresent', 'LpkTabbedTextOut', 'LpkUseGDIWidthCache', 'LpkpEditControlSize', 'LpkpInitializeEditControl', 'MaskBlt', 'MirrorRgn', 'ModerncoreGdiInit', 'ModifyWorldTransform', 'MoveToEx', 'NamedEscape', 'OffsetClipRgn', 'OffsetRgn', 'OffsetViewportOrgEx', 'OffsetWindowOrgEx', 'PATHOBJ_bEnum', 'PATHOBJ_bEnumClipLines', 'PATHOBJ_vEnumStart', 'PATHOBJ_vEnumStartClipLines', 'PATHOBJ_vGetBounds', 'PaintRgn', 'PatBlt', 'PathToRegion', 'Pie', 'PlayEnhMetaFile', 'PlayEnhMetaFileRecord', 'PlayMetaFile', 'PlayMetaFileRecord', 'PlgBlt', 'PolyBezier', 'PolyBezierTo', 'PolyDraw', 'PolyPatBlt', 'PolyPolygon', 'PolyPolyline', 'PolyTextOutA', 'PolyTextOutW', 'Polygon', 'Polyline', 'PolylineTo', 'PtInRegion', 'PtVisible', 'QueryFontAssocStatus', 'RealizePalette', 'RectInRegion', 'RectVisible', 'Rectangle', 'RemoveFontMemResourceEx', 'RemoveFontResourceA', 'RemoveFontResourceExA', 'RemoveFontResourceExW', 'RemoveFontResourceTracking', 'RemoveFontResourceW', 'ResetDCA', 'ResetDCW', 'ResizePalette', 'RestoreDC', 'RoundRect', 'STROBJ_bEnum', 'STROBJ_bEnumPositionsOnly', 'STROBJ_bGetAdvanceWidths', 'STROBJ_dwGetCodePage', 'STROBJ_vEnumStart', 'SaveDC', 'ScaleRgn', 'ScaleValues', 'ScaleViewportExtEx', 'ScaleWindowExtEx', 'ScriptApplyDigitSubstitution', 'ScriptApplyLogicalWidth', 'ScriptBreak', 'ScriptCPtoX', 'ScriptCacheGetHeight', 'ScriptFreeCache', 'ScriptGetCMap', 'ScriptGetFontAlternateGlyphs', 'ScriptGetFontFeatureTags', 'ScriptGetFontLanguageTags', 'ScriptGetFontProperties', 'ScriptGetFontScriptTags', 'ScriptGetGlyphABCWidth', 'ScriptGetLogicalWidths', 'ScriptGetProperties', 'ScriptIsComplex', 'ScriptItemize', 'ScriptItemizeOpenType', 'ScriptJustify', 'ScriptLayout', 'ScriptPlace', 'ScriptPlaceOpenType', 'ScriptPositionSingleGlyph', 'ScriptRecordDigitSubstitution', 'ScriptShape', 'ScriptShapeOpenType', 'ScriptStringAnalyse', 'ScriptStringCPtoX', 'ScriptStringFree', 'ScriptStringGetLogicalWidths', 'ScriptStringGetOrder', 'ScriptStringOut', 'ScriptStringValidate', 'ScriptStringXtoCP', 'ScriptString_pLogAttr', 'ScriptString_pSize', 'ScriptString_pcOutChars', 'ScriptSubstituteSingleGlyph', 'ScriptTextOut', 'ScriptXtoCP', 'SelectBrushLocal', 'SelectClipPath', 'SelectClipRgn', 'SelectFontLocal', 'SelectObject', 'SelectPalette', 'SetAbortProc', 'SetArcDirection', 'SetBitmapAttributes', 'SetBitmapBits', 'SetBitmapDimensionEx', 'SetBkColor', 'SetBkMode', 'SetBoundsRect', 'SetBrushAttributes', 'SetBrushOrgEx', 'SetColorAdjustment', 'SetColorSpace', 'SetDCBrushColor', 'SetDCPenColor', 'SetDIBColorTable', 'SetDIBits', 'SetDIBitsToDevice', 'SetDeviceGammaRamp', 'SetEnhMetaFileBits', 'SetFontEnumeration', 'SetGraphicsMode', 'SetICMMode', 'SetICMProfileA', 'SetICMProfileW', 'SetLayout', 'SetLayoutWidth', 'SetMagicColors', 'SetMapMode', 'SetMapperFlags', 'SetMetaFileBitsEx', 'SetMetaRgn', 'SetMiterLimit', 'SetOPMSigningKeyAndSequenceNumbers', 'SetPaletteEntries', 'SetPixel', 'SetPixelFormat', 'SetPixelV', 'SetPolyFillMode', 'SetROP2', 'SetRectRgn', 'SetRelAbs', 'SetStretchBltMode', 'SetSystemPaletteUse', 'SetTextAlign', 'SetTextCharacterExtra', 'SetTextColor', 'SetTextJustification', 'SetViewportExtEx', 'SetViewportOrgEx', 'SetVirtualResolution', 'SetWinMetaFileBits', 'SetWindowExtEx', 'SetWindowOrgEx', 'SetWorldTransform', 'StartDocA', 'StartDocW', 'StartFormPage', 'StartPage', 'StretchBlt', 'StretchDIBits', 'StrokeAndFillPath', 'StrokePath', 'SwapBuffers', 'TextOutA', 'TextOutW', 'TranslateCharsetInfo', 'UnloadNetworkFonts', 'UnrealizeObject', 'UpdateColors', 'UpdateICMRegKeyA', 'UpdateICMRegKeyW', 'UspAllocCache', 'UspAllocTemp', 'UspFreeMem', 'WidenPath', 'XFORMOBJ_bApplyXform', 'XFORMOBJ_iGetXform', 'XLATEOBJ_cGetPalette', 'XLATEOBJ_hGetColorTransform', 'XLATEOBJ_iXlate', 'XLATEOBJ_piVector', 'bCreateDCW', 'bDeleteLDC', 'bInitSystemAndFontsDirectoriesW', 'bMakePathNameW', 'cGetTTFFromFOT', 'fpClosePrinter', 'ftsWordBreak', 'gMaxGdiHandleCount', 'gW32PID', 'g_systemCallFilterId', 'gdiPlaySpoolStream', 'ghICM', 'hGetPEBHandle', 'pGdiDevCaps', 'pGdiSharedHandleTable', 'pGdiSharedMemory', 'pldcGet', 'semDxTrimNotification', 'vSetPldc', 'AddMRUStringW', 'CreateMRUListW', 'CreateMappedBitmap', 'CreatePropertySheetPage', 'CreatePropertySheetPageA', 'CreatePropertySheetPageW', 'CreateStatusWindow', 'CreateStatusWindowA', 'CreateStatusWindowW', 'CreateToolbar', 'CreateToolbarEx', 'CreateUpDownControl', 'DPA_Clone', 'DPA_Create', 'DPA_CreateEx', 'DPA_DeleteAllPtrs', 'DPA_DeletePtr', 'DPA_Destroy', 'DPA_DestroyCallback', 'DPA_EnumCallback', 'DPA_GetPtr', 'DPA_GetPtrIndex', 'DPA_Grow', 'DPA_InsertPtr', 'DPA_LoadStream', 'DPA_Merge', 'DPA_SaveStream', 'DPA_Search', 'DPA_SetPtr', 'DPA_Sort', 'DSA_Create', 'DSA_DeleteAllItems', 'DSA_DeleteItem', 'DSA_Destroy', 'DSA_DestroyCallback', 'DSA_EnumCallback', 'DSA_GetItem', 'DSA_GetItemPtr', 'DSA_InsertItem', 'DSA_SetItem', 'DefSubclassProc', 'DestroyPropertySheetPage', 'DllGetVersion', 'DrawInsert', 'DrawStatusText', 'DrawStatusTextA', 'DrawStatusTextW', 'EnumMRUListW', 'FlatSB_EnableScrollBar', 'FlatSB_GetScrollInfo', 'FlatSB_GetScrollPos', 'FlatSB_GetScrollProp', 'FlatSB_GetScrollPropPtr', 'FlatSB_GetScrollRange', 'FlatSB_SetScrollInfo', 'FlatSB_SetScrollPos', 'FlatSB_SetScrollProp', 'FlatSB_SetScrollRange', 'FlatSB_ShowScrollBar', 'FreeMRUList', 'GetEffectiveClientRect', 'GetMUILanguage', 'ImageList_Add', 'ImageList_AddIcon', 'ImageList_AddMasked', 'ImageList_BeginDrag', 'ImageList_Copy', 'ImageList_Create', 'ImageList_Destroy', 'ImageList_DragEnter', 'ImageList_DragLeave', 'ImageList_DragMove', 'ImageList_DragShowNolock', 'ImageList_Draw', 'ImageList_DrawEx', 'ImageList_DrawIndirect', 'ImageList_Duplicate', 'ImageList_EndDrag', 'ImageList_GetBkColor', 'ImageList_GetDragImage', 'ImageList_GetFlags', 'ImageList_GetIcon', 'ImageList_GetIconSize', 'ImageList_GetImageCount', 'ImageList_GetImageInfo', 'ImageList_GetImageRect', 'ImageList_LoadImage', 'ImageList_LoadImageA', 'ImageList_LoadImageW', 'ImageList_Merge', 'ImageList_Read', 'ImageList_Remove', 'ImageList_Replace', 'ImageList_ReplaceIcon', 'ImageList_SetBkColor', 'ImageList_SetDragCursorImage', 'ImageList_SetFilter', 'ImageList_SetFlags', 'ImageList_SetIconSize', 'ImageList_SetImageCount', 'ImageList_SetOverlayImage', 'ImageList_Write', 'InitCommonControls', 'InitCommonControlsEx', 'InitMUILanguage', 'InitializeFlatSB', 'LBItemFromPt', 'MakeDragList', 'MenuHelp', 'PropertySheet', 'PropertySheetA', 'PropertySheetW', 'RegisterClassNameW', 'RemoveWindowSubclass', 'SetWindowSubclass', 'ShowHideMenuCtl', 'Str_SetPtrW', 'UninitializeFlatSB', '_TrackMouseEvent', 'BindMoniker', 'CLIPFORMAT_UserFree', 'CLIPFORMAT_UserFree64', 'CLIPFORMAT_UserFreeExt', 'CLIPFORMAT_UserMarshal', 'CLIPFORMAT_UserMarshal64', 'CLIPFORMAT_UserMarshalExt', 'CLIPFORMAT_UserSize', 'CLIPFORMAT_UserSize64', 'CLIPFORMAT_UserSizeExt', 'CLIPFORMAT_UserUnmarshal', 'CLIPFORMAT_UserUnmarshal64', 'CLIPFORMAT_UserUnmarshalExt', 'CLSIDFromOle1Class', 'CLSIDFromProgID', 'CLSIDFromProgIDEx', 'CLSIDFromString', 'CStdAsyncStubBuffer2_Connect', 'CStdAsyncStubBuffer2_Disconnect', 'CStdAsyncStubBuffer2_Release', 'CStdAsyncStubBuffer_AddRef', 'CStdAsyncStubBuffer_Connect', 'CStdAsyncStubBuffer_Disconnect', 'CStdAsyncStubBuffer_Invoke', 'CStdAsyncStubBuffer_QueryInterface', 'CStdAsyncStubBuffer_Release', 'CStdStubBuffer2_Connect', 'CStdStubBuffer2_CountRefs', 'CStdStubBuffer2_Disconnect', 'CStdStubBuffer2_QueryInterface', 'CheckInitDde', 'CleanROTForApartment', 'ClipboardProcessUninitialize', 'CoAddRefServerProcess', 'CoAicGetTokenForCOM', 'CoAllowSetForegroundWindow', 'CoAllowUnmarshalerCLSID', 'CoBuildVersion', 'CoCancelCall', 'CoCheckElevationEnabled', 'CoCopyProxy', 'CoCreateFreeThreadedMarshaler', 'CoCreateGuid', 'CoCreateInstance', 'CoCreateInstanceEx', 'CoCreateInstanceFromApp', 'CoCreateObjectInContext', 'CoDeactivateObject', 'CoDecodeProxy', 'CoDecrementMTAUsage', 'CoDisableCallCancellation', 'CoDisconnectContext', 'CoDisconnectObject', 'CoDosDateTimeToFileTime', 'CoEnableCallCancellation', 'CoFileTimeNow', 'CoFileTimeToDosDateTime', 'CoFreeAllLibraries', 'CoFreeLibrary', 'CoFreeUnusedLibraries', 'CoFreeUnusedLibrariesEx', 'CoGetActivationState', 'CoGetApartmentID', 'CoGetApartmentType', 'CoGetCallContext', 'CoGetCallState', 'CoGetCallerTID', 'CoGetCancelObject', 'CoGetClassObject', 'CoGetClassVersion', 'CoGetComCatalog', 'CoGetContextToken', 'CoGetCurrentLogicalThreadId', 'CoGetCurrentProcess', 'CoGetDefaultContext', 'CoGetInstanceFromFile', 'CoGetInstanceFromIStorage', 'CoGetInterceptor', 'CoGetInterceptorForOle32', 'CoGetInterceptorFromTypeInfo', 'CoGetInterfaceAndReleaseStream', 'CoGetMalloc', 'CoGetMarshalSizeMax', 'CoGetModuleType', 'CoGetObject', 'CoGetObjectContext', 'CoGetPSClsid', 'CoGetProcessIdentifier', 'CoGetStandardMarshal', 'CoGetStdMarshalEx', 'CoGetSystemSecurityPermissions', 'CoGetSystemWow64DirectoryW', 'CoGetTreatAsClass', 'CoHandlePriorityEventsFromMessagePump', 'CoImpersonateClient', 'CoIncrementMTAUsage', 'CoInitialize', 'CoInitializeEx', 'CoInitializeSecurity', 'CoInitializeWOW', 'CoInstall', 'CoInvalidateRemoteMachineBindings', 'CoIsHandlerConnected', 'CoIsOle1Class', 'CoLoadLibrary', 'CoLockObjectExternal', 'CoMarshalHresult', 'CoMarshalInterThreadInterfaceInStream', 'CoMarshalInterface', 'CoPopServiceDomain', 'CoPushServiceDomain', 'CoQueryAuthenticationServices', 'CoQueryClientBlanket', 'CoQueryProxyBlanket', 'CoQueryReleaseObject', 'CoReactivateObject', 'CoRegisterActivationFilter', 'CoRegisterChannelHook', 'CoRegisterClassObject', 'CoRegisterInitializeSpy', 'CoRegisterMallocSpy', 'CoRegisterMessageFilter', 'CoRegisterPSClsid', 'CoRegisterSurrogate', 'CoRegisterSurrogateEx', 'CoReleaseMarshalData', 'CoReleaseServerProcess', 'CoResumeClassObjects', 'CoRetireServer', 'CoRevertToSelf', 'CoRevokeClassObject', 'CoRevokeInitializeSpy', 'CoRevokeMallocSpy', 'CoSetCancelObject', 'CoSetMessageDispatcher', 'CoSetProxyBlanket', 'CoSetState', 'CoSuspendClassObjects', 'CoSwitchCallContext', 'CoTaskMemAlloc', 'CoTaskMemFree', 'CoTaskMemRealloc', 'CoTestCancel', 'CoTreatAsClass', 'CoUninitialize', 'CoUnloadingWOW', 'CoUnmarshalHresult', 'CoUnmarshalInterface', 'CoVrfCheckThreadState', 'CoVrfGetThreadState', 'CoVrfReleaseThreadState', 'CoWaitForMultipleHandles', 'CoWaitForMultipleObjects', 'ComPs_NdrDllCanUnloadNow', 'ComPs_NdrDllGetClassObject', 'ComPs_NdrDllRegisterProxy', 'ComPs_NdrDllUnregisterProxy', 'CreateAntiMoniker', 'CreateBindCtx', 'CreateClassMoniker', 'CreateDataAdviseHolder', 'CreateDataCache', 'CreateErrorInfo', 'CreateFileMoniker', 'CreateGenericComposite', 'CreateILockBytesOnHGlobal', 'CreateItemMoniker', 'CreateObjrefMoniker', 'CreateOleAdviseHolder', 'CreatePointerMoniker', 'CreateStdProgressIndicator', 'CreateStreamOnHGlobal', 'DcomChannelSetHResult', 'DdeBindToObject', 'DeletePatternAndExtensionTables', 'DestroyRunningObjectTable', 'DllDebugObjectRPCHook', 'DllGetClassObject', 'DllGetClassObjectWOW', 'DllRegisterServer', 'DoDragDrop', 'DragDropSetFDT', 'EnableHookObject', 'FindExt', 'FmtIdToPropStgName', 'FreePropVariantArray', 'GetActiveObjectExt', 'GetClassFile', 'GetConvertStg', 'GetDocumentBitStg', 'GetErrorInfo', 'GetHGlobalFromILockBytes', 'GetHGlobalFromStream', 'GetHookInterface', 'GetObjectFromRotByPath', 'GetRunningObjectTable', 'HACCEL_UserFree', 'HACCEL_UserFree64', 'HACCEL_UserMarshal', 'HACCEL_UserMarshal64', 'HACCEL_UserSize', 'HACCEL_UserSize64', 'HACCEL_UserUnmarshal', 'HACCEL_UserUnmarshal64', 'HBITMAP_UserFree', 'HBITMAP_UserFree64', 'HBITMAP_UserMarshal', 'HBITMAP_UserMarshal64', 'HBITMAP_UserSize', 'HBITMAP_UserSize64', 'HBITMAP_UserUnmarshal', 'HBITMAP_UserUnmarshal64', 'HBRUSH_UserFree', 'HBRUSH_UserFree64', 'HBRUSH_UserMarshal', 'HBRUSH_UserMarshal64', 'HBRUSH_UserSize', 'HBRUSH_UserSize64', 'HBRUSH_UserUnmarshal', 'HBRUSH_UserUnmarshal64', 'HDC_UserFree', 'HDC_UserFree64', 'HDC_UserMarshal', 'HDC_UserMarshal64', 'HDC_UserSize', 'HDC_UserSize64', 'HDC_UserUnmarshal', 'HDC_UserUnmarshal64', 'HENHMETAFILE_UserFree', 'HENHMETAFILE_UserFree64', 'HENHMETAFILE_UserMarshal', 'HENHMETAFILE_UserMarshal64', 'HENHMETAFILE_UserSize', 'HENHMETAFILE_UserSize64', 'HENHMETAFILE_UserUnmarshal', 'HENHMETAFILE_UserUnmarshal64', 'HGLOBAL_UserFree', 'HGLOBAL_UserFree64', 'HGLOBAL_UserMarshal', 'HGLOBAL_UserMarshal64', 'HGLOBAL_UserSize', 'HGLOBAL_UserSize64', 'HGLOBAL_UserUnmarshal', 'HGLOBAL_UserUnmarshal64', 'HICON_UserFree', 'HICON_UserFree64', 'HICON_UserMarshal', 'HICON_UserMarshal64', 'HICON_UserSize', 'HICON_UserSize64', 'HICON_UserUnmarshal', 'HICON_UserUnmarshal64', 'HMENU_UserFree', 'HMENU_UserFree64', 'HMENU_UserMarshal', 'HMENU_UserMarshal64', 'HMENU_UserSize', 'HMENU_UserSize64', 'HMENU_UserUnmarshal', 'HMENU_UserUnmarshal64', 'HMETAFILEPICT_UserFree', 'HMETAFILEPICT_UserFree64', 'HMETAFILEPICT_UserMarshal', 'HMETAFILEPICT_UserMarshal64', 'HMETAFILEPICT_UserSize', 'HMETAFILEPICT_UserSize64', 'HMETAFILEPICT_UserUnmarshal', 'HMETAFILEPICT_UserUnmarshal64', 'HMETAFILE_UserFree', 'HMETAFILE_UserFree64', 'HMETAFILE_UserMarshal', 'HMETAFILE_UserMarshal64', 'HMETAFILE_UserSize', 'HMETAFILE_UserSize64', 'HMETAFILE_UserUnmarshal', 'HMETAFILE_UserUnmarshal64', 'HMONITOR_UserFree', 'HMONITOR_UserFree64', 'HMONITOR_UserMarshal', 'HMONITOR_UserMarshal64', 'HMONITOR_UserSize', 'HMONITOR_UserSize64', 'HMONITOR_UserUnmarshal', 'HMONITOR_UserUnmarshal64', 'HPALETTE_UserFree', 'HPALETTE_UserFree64', 'HPALETTE_UserFreeExt', 'HPALETTE_UserMarshal', 'HPALETTE_UserMarshal64', 'HPALETTE_UserMarshalExt', 'HPALETTE_UserSize', 'HPALETTE_UserSize64', 'HPALETTE_UserSizeExt', 'HPALETTE_UserUnmarshal', 'HPALETTE_UserUnmarshal64', 'HPALETTE_UserUnmarshalExt', 'HRGN_UserFree', 'HRGN_UserMarshal', 'HRGN_UserSize', 'HRGN_UserUnmarshal', 'HWND_UserFree', 'HWND_UserFree64', 'HWND_UserFree64Ext', 'HWND_UserFreeExt', 'HWND_UserMarshal', 'HWND_UserMarshal64', 'HWND_UserMarshal64Ext', 'HWND_UserMarshalExt', 'HWND_UserSize', 'HWND_UserSize64', 'HWND_UserSize64Ext', 'HWND_UserSizeExt', 'HWND_UserUnmarshal', 'HWND_UserUnmarshal64', 'HWND_UserUnmarshal64Ext', 'HWND_UserUnmarshalExt', 'HkOleRegisterObject', 'IIDFromString', 'IsAccelerator', 'IsEqualGUID', 'IsRoInitializeASTAAllowedInDesktop', 'IsValidIid', 'IsValidInterface', 'IsValidPtrIn', 'IsValidPtrOut', 'MkParseDisplayName', 'MonikerCommonPrefixWith', 'MonikerLoadTypeLib', 'MonikerRelativePathTo', 'NdrOleInitializeExtension', 'NdrProxyForwardingFunction10', 'NdrProxyForwardingFunction11', 'NdrProxyForwardingFunction12', 'NdrProxyForwardingFunction13', 'NdrProxyForwardingFunction14', 'NdrProxyForwardingFunction15', 'NdrProxyForwardingFunction16', 'NdrProxyForwardingFunction17', 'NdrProxyForwardingFunction18', 'NdrProxyForwardingFunction19', 'NdrProxyForwardingFunction20', 'NdrProxyForwardingFunction21', 'NdrProxyForwardingFunction22', 'NdrProxyForwardingFunction23', 'NdrProxyForwardingFunction24', 'NdrProxyForwardingFunction25', 'NdrProxyForwardingFunction26', 'NdrProxyForwardingFunction27', 'NdrProxyForwardingFunction28', 'NdrProxyForwardingFunction29', 'NdrProxyForwardingFunction3', 'NdrProxyForwardingFunction30', 'NdrProxyForwardingFunction31', 'NdrProxyForwardingFunction32', 'NdrProxyForwardingFunction4', 'NdrProxyForwardingFunction5', 'NdrProxyForwardingFunction6', 'NdrProxyForwardingFunction7', 'NdrProxyForwardingFunction8', 'NdrProxyForwardingFunction9', 'ObjectStublessClient10', 'ObjectStublessClient11', 'ObjectStublessClient12', 'ObjectStublessClient13', 'ObjectStublessClient14', 'ObjectStublessClient15', 'ObjectStublessClient16', 'ObjectStublessClient17', 'ObjectStublessClient18', 'ObjectStublessClient19', 'ObjectStublessClient20', 'ObjectStublessClient21', 'ObjectStublessClient22', 'ObjectStublessClient23', 'ObjectStublessClient24', 'ObjectStublessClient25', 'ObjectStublessClient26', 'ObjectStublessClient27', 'ObjectStublessClient28', 'ObjectStublessClient29', 'ObjectStublessClient3', 'ObjectStublessClient30', 'ObjectStublessClient31', 'ObjectStublessClient32', 'ObjectStublessClient4', 'ObjectStublessClient5', 'ObjectStublessClient6', 'ObjectStublessClient7', 'ObjectStublessClient8', 'ObjectStublessClient9', 'Ole32DllGetClassObject', 'OleBuildVersion', 'OleConvertIStorageToOLESTREAM', 'OleConvertIStorageToOLESTREAMEx', 'OleConvertOLESTREAMToIStorage', 'OleConvertOLESTREAMToIStorageEx', 'OleCreate', 'OleCreateDefaultHandler', 'OleCreateEmbeddingHelper', 'OleCreateEx', 'OleCreateFontIndirectExt', 'OleCreateFromData', 'OleCreateFromDataEx', 'OleCreateFromFile', 'OleCreateFromFileEx', 'OleCreateLink', 'OleCreateLinkEx', 'OleCreateLinkFromData', 'OleCreateLinkFromDataEx', 'OleCreateLinkToFile', 'OleCreateLinkToFileEx', 'OleCreateMenuDescriptor', 'OleCreatePictureIndirectExt', 'OleCreatePropertyFrameIndirectExt', 'OleCreateStaticFromData', 'OleDestroyMenuDescriptor', 'OleDoAutoConvert', 'OleDraw', 'OleDuplicateData', 'OleFlushClipboard', 'OleGetAutoConvert', 'OleGetClipboard', 'OleGetClipboardWithEnterpriseInfo', 'OleGetIconOfClass', 'OleGetIconOfFile', 'OleGetPackageClipboardOwner', 'OleIconToCursorExt', 'OleInitialize', 'OleInitializeWOW', 'OleIsCurrentClipboard', 'OleIsRunning', 'OleLoad', 'OleLoadFromStream', 'OleLoadPictureExt', 'OleLoadPictureFileExt', 'OleLoadPicturePathExt', 'OleLockRunning', 'OleMetafilePictFromIconAndLabel', 'OleNoteObjectVisible', 'OleQueryCreateFromData', 'OleQueryLinkFromData', 'OleRegEnumFormatEtc', 'OleRegEnumVerbs', 'OleRegGetMiscStatus', 'OleRegGetUserType', 'OleReleaseEnumVerbCache', 'OleRun', 'OleSave', 'OleSavePictureFileExt', 'OleSaveToStream', 'OleSetAutoConvert', 'OleSetClipboard', 'OleSetContainedObject', 'OleSetMenuDescriptor', 'OleTranslateAccelerator', 'OleTranslateColorExt', 'OleUninitialize', 'OpenOrCreateStream', 'ProgIDFromCLSID', 'PropStgNameToFmtId', 'PropSysAllocString', 'PropSysFreeString', 'PropVariantChangeType', 'PropVariantClear', 'PropVariantCopy', 'ReadClassStg', 'ReadClassStm', 'ReadFmtUserTypeStg', 'ReadOleStg', 'ReadStorageProperties', 'ReadStringStream', 'RegisterActiveObjectExt', 'RegisterDragDrop', 'ReleaseStgMedium', 'RevokeActiveObjectExt', 'RevokeDragDrop', 'RoGetAgileReference', 'SNB_UserFree', 'SNB_UserFree64', 'SNB_UserMarshal', 'SNB_UserMarshal64', 'SNB_UserSize', 'SNB_UserSize64', 'SNB_UserUnmarshal', 'SNB_UserUnmarshal64', 'STGMEDIUM_UserFree', 'STGMEDIUM_UserFree64', 'STGMEDIUM_UserFreeExt', 'STGMEDIUM_UserMarshal', 'STGMEDIUM_UserMarshal64', 'STGMEDIUM_UserMarshalExt', 'STGMEDIUM_UserSize', 'STGMEDIUM_UserSize64', 'STGMEDIUM_UserSizeExt', 'STGMEDIUM_UserUnmarshal', 'STGMEDIUM_UserUnmarshal64', 'STGMEDIUM_UserUnmarshalExt', 'SetConvertStg', 'SetDocumentBitStg', 'SetErrorInfo', 'SetOleautModule', 'SetWOWThunkGlobalPtr', 'StdTypesGetClassObject', 'StdTypesRegisterServer', 'StgConvertPropertyToVariant', 'StgConvertVariantToProperty', 'StgCreateDocfile', 'StgCreateDocfileOnILockBytes', 'StgCreatePropSetStg', 'StgCreatePropStg', 'StgCreateStorageEx', 'StgGetIFillLockBytesOnFile', 'StgGetIFillLockBytesOnILockBytes', 'StgIsStorageFile', 'StgIsStorageILockBytes', 'StgOpenAsyncDocfileOnIFillLockBytes', 'StgOpenPropStg', 'StgOpenStorage', 'StgOpenStorageEx', 'StgOpenStorageOnHandle', 'StgOpenStorageOnILockBytes', 'StgPropertyLengthAsVariant', 'StgSetTimes', 'StringFromCLSID', 'StringFromGUID2', 'StringFromIID', 'UpdateDCOMSettings', 'UpdateProcessTracing', 'UtConvertDvtd16toDvtd32', 'UtConvertDvtd32toDvtd16', 'UtGetDvtd16Info', 'UtGetDvtd32Info', 'WdtpInterfacePointer_UserFree', 'WdtpInterfacePointer_UserFree64', 'WdtpInterfacePointer_UserMarshal', 'WdtpInterfacePointer_UserMarshal64', 'WdtpInterfacePointer_UserSize', 'WdtpInterfacePointer_UserSize64', 'WdtpInterfacePointer_UserUnmarshal', 'WdtpInterfacePointer_UserUnmarshal64', 'WriteClassStg', 'WriteClassStm', 'WriteFmtUserTypeStg', 'WriteOleStg', 'WriteStorageProperties', 'WriteStringStream', 'CtfImmAppCompatEnableIMEonProtectedCode', 'CtfImmCoUninitialize', 'CtfImmDispatchDefImeMessage', 'CtfImmEnterCoInitCountSkipMode', 'CtfImmGenerateMessage', 'CtfImmGetCompatibleKeyboardLayout', 'CtfImmGetGlobalIMEStatus', 'CtfImmGetGuidAtom', 'CtfImmGetIMEFileName', 'CtfImmGetTMAEFlags', 'CtfImmHideToolbarWnd', 'CtfImmIsCiceroEnabled', 'CtfImmIsCiceroStartedInThread', 'CtfImmIsComStartedInThread', 'CtfImmIsGuidMapEnable', 'CtfImmIsTextFrameServiceDisabled', 'CtfImmLastEnabledWndDestroy', 'CtfImmLeaveCoInitCountSkipMode', 'CtfImmNotify', 'CtfImmRestoreToolbarWnd', 'CtfImmSetAppCompatFlags', 'CtfImmSetCiceroStartInThread', 'CtfImmSetDefaultRemoteKeyboardLayout', 'CtfImmTIMActivate', 'GetKeyboardLayoutCP', 'ImmActivateLayout', 'ImmAssociateContext', 'ImmAssociateContextEx', 'ImmCallImeConsoleIME', 'ImmConfigureIMEA', 'ImmConfigureIMEW', 'ImmCreateContext', 'ImmCreateIMCC', 'ImmCreateSoftKeyboard', 'ImmDestroyContext', 'ImmDestroyIMCC', 'ImmDestroySoftKeyboard', 'ImmDisableIME', 'ImmDisableIme', 'ImmDisableLegacyIME', 'ImmDisableTextFrameService', 'ImmEnumInputContext', 'ImmEnumRegisterWordA', 'ImmEnumRegisterWordW', 'ImmEscapeA', 'ImmEscapeW', 'ImmFreeLayout', 'ImmGenerateMessage', 'ImmGetAppCompatFlags', 'ImmGetCandidateListA', 'ImmGetCandidateListCountA', 'ImmGetCandidateListCountW', 'ImmGetCandidateListW', 'ImmGetCandidateWindow', 'ImmGetCompositionFontA', 'ImmGetCompositionFontW', 'ImmGetCompositionStringA', 'ImmGetCompositionStringW', 'ImmGetCompositionWindow', 'ImmGetContext', 'ImmGetConversionListA', 'ImmGetConversionListW', 'ImmGetConversionStatus', 'ImmGetDefaultIMEWnd', 'ImmGetDescriptionA', 'ImmGetDescriptionW', 'ImmGetGuideLineA', 'ImmGetGuideLineW', 'ImmGetHotKey', 'ImmGetIMCCLockCount', 'ImmGetIMCCSize', 'ImmGetIMCLockCount', 'ImmGetIMEFileNameA', 'ImmGetIMEFileNameW', 'ImmGetImeInfoEx', 'ImmGetImeMenuItemsA', 'ImmGetImeMenuItemsW', 'ImmGetOpenStatus', 'ImmGetProperty', 'ImmGetRegisterWordStyleA', 'ImmGetRegisterWordStyleW', 'ImmGetStatusWindowPos', 'ImmGetVirtualKey', 'ImmIMPGetIMEA', 'ImmIMPGetIMEW', 'ImmIMPQueryIMEA', 'ImmIMPQueryIMEW', 'ImmIMPSetIMEA', 'ImmIMPSetIMEW', 'ImmInstallIMEA', 'ImmInstallIMEW', 'ImmIsIME', 'ImmIsUIMessageA', 'ImmIsUIMessageW', 'ImmLoadIME', 'ImmLoadLayout', 'ImmLockClientImc', 'ImmLockIMC', 'ImmLockIMCC', 'ImmLockImeDpi', 'ImmNotifyIME', 'ImmProcessKey', 'ImmPutImeMenuItemsIntoMappedFile', 'ImmReSizeIMCC', 'ImmRegisterClient', 'ImmRegisterWordA', 'ImmRegisterWordW', 'ImmReleaseContext', 'ImmRequestMessageA', 'ImmRequestMessageW', 'ImmSendIMEMessageExA', 'ImmSendIMEMessageExW', 'ImmSetActiveContext', 'ImmSetActiveContextConsoleIME', 'ImmSetCandidateWindow', 'ImmSetCompositionFontA', 'ImmSetCompositionFontW', 'ImmSetCompositionStringA', 'ImmSetCompositionStringW', 'ImmSetCompositionWindow', 'ImmSetConversionStatus', 'ImmSetHotKey', 'ImmSetOpenStatus', 'ImmSetStatusWindowPos', 'ImmShowSoftKeyboard', 'ImmSimulateHotKey', 'ImmSystemHandler', 'ImmTranslateMessage', 'ImmUnlockClientImc', 'ImmUnlockIMC', 'ImmUnlockIMCC', 'ImmUnlockImeDpi', 'ImmUnregisterWordA', 'ImmUnregisterWordW', 'ImmWINNLSEnableIME', 'ImmWINNLSGetEnableStatus', 'ImmWINNLSGetIMEHotkey', 'CloseDriver', 'DefDriverProc', 'DriverCallback', 'DrvGetModuleHandle', 'GetDriverModuleHandle', 'OpenDriver', 'PlaySound', 'PlaySoundA', 'PlaySoundW', 'SendDriverMessage', 'WOWAppExit', 'auxGetDevCapsA', 'auxGetDevCapsW', 'auxGetNumDevs', 'auxGetVolume', 'auxOutMessage', 'auxSetVolume', 'joyConfigChanged', 'joyGetDevCapsA', 'joyGetDevCapsW', 'joyGetNumDevs', 'joyGetPos', 'joyGetPosEx', 'joyGetThreshold', 'joyReleaseCapture', 'joySetCapture', 'joySetThreshold', 'mciDriverNotify', 'mciDriverYield', 'mciExecute', 'mciFreeCommandResource', 'mciGetCreatorTask', 'mciGetDeviceIDA', 'mciGetDeviceIDFromElementIDA', 'mciGetDeviceIDFromElementIDW', 'mciGetDeviceIDW', 'mciGetDriverData', 'mciGetErrorStringA', 'mciGetErrorStringW', 'mciGetYieldProc', 'mciLoadCommandResource', 'mciSendCommandA', 'mciSendCommandW', 'mciSendStringA', 'mciSendStringW', 'mciSetDriverData', 'mciSetYieldProc', 'midiConnect', 'midiDisconnect', 'midiInAddBuffer', 'midiInClose', 'midiInGetDevCapsA', 'midiInGetDevCapsW', 'midiInGetErrorTextA', 'midiInGetErrorTextW', 'midiInGetID', 'midiInGetNumDevs', 'midiInMessage', 'midiInOpen', 'midiInPrepareHeader', 'midiInReset', 'midiInStart', 'midiInStop', 'midiInUnprepareHeader', 'midiOutCacheDrumPatches', 'midiOutCachePatches', 'midiOutClose', 'midiOutGetDevCapsA', 'midiOutGetDevCapsW', 'midiOutGetErrorTextA', 'midiOutGetErrorTextW', 'midiOutGetID', 'midiOutGetNumDevs', 'midiOutGetVolume', 'midiOutLongMsg', 'midiOutMessage', 'midiOutOpen', 'midiOutPrepareHeader', 'midiOutReset', 'midiOutSetVolume', 'midiOutShortMsg', 'midiOutUnprepareHeader', 'midiStreamClose', 'midiStreamOpen', 'midiStreamOut', 'midiStreamPause', 'midiStreamPosition', 'midiStreamProperty', 'midiStreamRestart', 'midiStreamStop', 'mixerClose', 'mixerGetControlDetailsA', 'mixerGetControlDetailsW', 'mixerGetDevCapsA', 'mixerGetDevCapsW', 'mixerGetID', 'mixerGetLineControlsA', 'mixerGetLineControlsW', 'mixerGetLineInfoA', 'mixerGetLineInfoW', 'mixerGetNumDevs', 'mixerMessage', 'mixerOpen', 'mixerSetControlDetails', 'mmDrvInstall', 'mmGetCurrentTask', 'mmTaskBlock', 'mmTaskCreate', 'mmTaskSignal', 'mmTaskYield', 'mmioAdvance', 'mmioAscend', 'mmioClose', 'mmioCreateChunk', 'mmioDescend', 'mmioFlush', 'mmioGetInfo', 'mmioInstallIOProcA', 'mmioInstallIOProcW', 'mmioOpenA', 'mmioOpenW', 'mmioRead', 'mmioRenameA', 'mmioRenameW', 'mmioSeek', 'mmioSendMessage', 'mmioSetBuffer', 'mmioSetInfo', 'mmioStringToFOURCCA', 'mmioStringToFOURCCW', 'mmioWrite', 'mmsystemGetVersion', 'sndPlaySoundA', 'sndPlaySoundW', 'timeBeginPeriod', 'timeEndPeriod', 'timeGetDevCaps', 'timeGetSystemTime', 'timeGetTime', 'timeKillEvent', 'timeSetEvent', 'waveInAddBuffer', 'waveInClose', 'waveInGetDevCapsA', 'waveInGetDevCapsW', 'waveInGetErrorTextA', 'waveInGetErrorTextW', 'waveInGetID', 'waveInGetNumDevs', 'waveInGetPosition', 'waveInMessage', 'waveInOpen', 'waveInPrepareHeader', 'waveInReset', 'waveInStart', 'waveInStop', 'waveInUnprepareHeader', 'waveOutBreakLoop', 'waveOutClose', 'waveOutGetDevCapsA', 'waveOutGetDevCapsW', 'waveOutGetErrorTextA', 'waveOutGetErrorTextW', 'waveOutGetID', 'waveOutGetNumDevs', 'waveOutGetPitch', 'waveOutGetPlaybackRate', 'waveOutGetPosition', 'waveOutGetVolume', 'waveOutMessage', 'waveOutOpen', 'waveOutPause', 'waveOutPrepareHeader', 'waveOutReset', 'waveOutRestart', 'waveOutSetPitch', 'waveOutSetPlaybackRate', 'waveOutSetVolume', 'waveOutUnprepareHeader', 'waveOutWrite', 'AddIPAddress', 'AllocateAndGetInterfaceInfoFromStack', 'AllocateAndGetIpAddrTableFromStack', 'CancelIPChangeNotify', 'CancelIfTimestampConfigChange', 'CancelMibChangeNotify2', 'CaptureInterfaceHardwareCrossTimestamp', 'CloseCompartment', 'CloseGetIPPhysicalInterfaceForDestination', 'ConvertCompartmentGuidToId', 'ConvertCompartmentIdToGuid', 'ConvertGuidToStringA', 'ConvertGuidToStringW', 'ConvertInterfaceAliasToLuid', 'ConvertInterfaceGuidToLuid', 'ConvertInterfaceIndexToLuid', 'ConvertInterfaceLuidToAlias', 'ConvertInterfaceLuidToGuid', 'ConvertInterfaceLuidToIndex', 'ConvertInterfaceLuidToNameA', 'ConvertInterfaceLuidToNameW', 'ConvertInterfaceNameToLuidA', 'ConvertInterfaceNameToLuidW', 'ConvertInterfacePhysicalAddressToLuid', 'ConvertIpv4MaskToLength', 'ConvertLengthToIpv4Mask', 'ConvertRemoteInterfaceAliasToLuid', 'ConvertRemoteInterfaceGuidToLuid', 'ConvertRemoteInterfaceIndexToLuid', 'ConvertRemoteInterfaceLuidToAlias', 'ConvertRemoteInterfaceLuidToGuid', 'ConvertRemoteInterfaceLuidToIndex', 'ConvertStringToGuidA', 'ConvertStringToGuidW', 'ConvertStringToInterfacePhysicalAddress', 'CreateAnycastIpAddressEntry', 'CreateCompartment', 'CreateIpForwardEntry', 'CreateIpForwardEntry2', 'CreateIpNetEntry', 'CreateIpNetEntry2', 'CreatePersistentTcpPortReservation', 'CreatePersistentUdpPortReservation', 'CreateProxyArpEntry', 'CreateSortedAddressPairs', 'CreateUnicastIpAddressEntry', 'DeleteAnycastIpAddressEntry', 'DeleteCompartment', 'DeleteIPAddress', 'DeleteIpForwardEntry', 'DeleteIpForwardEntry2', 'DeleteIpNetEntry', 'DeleteIpNetEntry2', 'DeletePersistentTcpPortReservation', 'DeletePersistentUdpPortReservation', 'DeleteProxyArpEntry', 'DeleteUnicastIpAddressEntry', 'DisableMediaSense', 'EnableRouter', 'FlushIpNetTable', 'FlushIpNetTable2', 'FlushIpPathTable', 'FreeDnsSettings', 'FreeInterfaceDnsSettings', 'FreeMibTable', 'GetAdapterIndex', 'GetAdapterOrderMap', 'GetAdaptersAddresses', 'GetAdaptersInfo', 'GetAnycastIpAddressEntry', 'GetAnycastIpAddressTable', 'GetBestInterface', 'GetBestInterfaceEx', 'GetBestRoute', 'GetBestRoute2', 'GetCurrentThreadCompartmentId', 'GetCurrentThreadCompartmentScope', 'GetDefaultCompartmentId', 'GetDnsSettings', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'GetFriendlyIfIndex', 'GetIcmpStatistics', 'GetIcmpStatisticsEx', 'GetIfEntry', 'GetIfEntry2', 'GetIfEntry2Ex', 'GetIfStackTable', 'GetIfTable', 'GetIfTable2', 'GetIfTable2Ex', 'GetInterfaceCompartmentId', 'GetInterfaceCurrentTimestampCapabilities', 'GetInterfaceDnsSettings', 'GetInterfaceHardwareTimestampCapabilities', 'GetInterfaceInfo', 'GetInvertedIfStackTable', 'GetIpAddrTable', 'GetIpErrorString', 'GetIpForwardEntry2', 'GetIpForwardTable', 'GetIpForwardTable2', 'GetIpInterfaceEntry', 'GetIpInterfaceTable', 'GetIpNetEntry2', 'GetIpNetTable', 'GetIpNetTable2', 'GetIpNetworkConnectionBandwidthEstimates', 'GetIpPathEntry', 'GetIpPathTable', 'GetIpStatistics', 'GetIpStatisticsEx', 'GetJobCompartmentId', 'GetMulticastIpAddressEntry', 'GetMulticastIpAddressTable', 'GetNetworkInformation', 'GetNetworkParams', 'GetNumberOfInterfaces', 'GetOwnerModuleFromPidAndInfo', 'GetOwnerModuleFromTcp6Entry', 'GetOwnerModuleFromTcpEntry', 'GetOwnerModuleFromUdp6Entry', 'GetOwnerModuleFromUdpEntry', 'GetPerAdapterInfo', 'GetPerTcp6ConnectionEStats', 'GetPerTcp6ConnectionStats', 'GetPerTcpConnectionEStats', 'GetPerTcpConnectionStats', 'GetRTTAndHopCount', 'GetSessionCompartmentId', 'GetTcp6Table', 'GetTcp6Table2', 'GetTcpStatistics', 'GetTcpStatisticsEx', 'GetTcpStatisticsEx2', 'GetTcpTable', 'GetTcpTable2', 'GetTeredoPort', 'GetUdp6Table', 'GetUdpStatistics', 'GetUdpStatisticsEx', 'GetUdpStatisticsEx2', 'GetUdpTable', 'GetUniDirectionalAdapterInfo', 'GetUnicastIpAddressEntry', 'GetUnicastIpAddressTable', 'GetWPAOACSupportLevel', 'Icmp6CreateFile', 'Icmp6ParseReplies', 'Icmp6SendEcho2', 'IcmpCloseHandle', 'IcmpCreateFile', 'IcmpParseReplies', 'IcmpSendEcho', 'IcmpSendEcho2', 'IcmpSendEcho2Ex', 'InitializeCompartmentEntry', 'InitializeIpForwardEntry', 'InitializeIpInterfaceEntry', 'InitializeUnicastIpAddressEntry', 'InternalCleanupPersistentStore', 'InternalCreateAnycastIpAddressEntry', 'InternalCreateIpForwardEntry', 'InternalCreateIpForwardEntry2', 'InternalCreateIpNetEntry', 'InternalCreateIpNetEntry2', 'InternalCreateUnicastIpAddressEntry', 'InternalDeleteAnycastIpAddressEntry', 'InternalDeleteIpForwardEntry', 'InternalDeleteIpForwardEntry2', 'InternalDeleteIpNetEntry', 'InternalDeleteIpNetEntry2', 'InternalDeleteUnicastIpAddressEntry', 'InternalFindInterfaceByAddress', 'InternalGetAnycastIpAddressEntry', 'InternalGetAnycastIpAddressTable', 'InternalGetBoundTcp6EndpointTable', 'InternalGetBoundTcpEndpointTable', 'InternalGetForwardIpTable2', 'InternalGetIPPhysicalInterfaceForDestination', 'InternalGetIfEntry2', 'InternalGetIfTable', 'InternalGetIfTable2', 'InternalGetIpAddrTable', 'InternalGetIpForwardEntry2', 'InternalGetIpForwardTable', 'InternalGetIpInterfaceEntry', 'InternalGetIpInterfaceTable', 'InternalGetIpNetEntry2', 'InternalGetIpNetTable', 'InternalGetIpNetTable2', 'InternalGetMulticastIpAddressEntry', 'InternalGetMulticastIpAddressTable', 'InternalGetRtcSlotInformation', 'InternalGetTcp6Table2', 'InternalGetTcp6TableWithOwnerModule', 'InternalGetTcp6TableWithOwnerPid', 'InternalGetTcpTable', 'InternalGetTcpTable2', 'InternalGetTcpTableEx', 'InternalGetTcpTableWithOwnerModule', 'InternalGetTcpTableWithOwnerPid', 'InternalGetTunnelPhysicalAdapter', 'InternalGetUdp6TableWithOwnerModule', 'InternalGetUdp6TableWithOwnerPid', 'InternalGetUdpTable', 'InternalGetUdpTableEx', 'InternalGetUdpTableWithOwnerModule', 'InternalGetUdpTableWithOwnerPid', 'InternalGetUnicastIpAddressEntry', 'InternalGetUnicastIpAddressTable', 'InternalIcmpCreateFileEx', 'InternalSetIfEntry', 'InternalSetIpForwardEntry', 'InternalSetIpForwardEntry2', 'InternalSetIpInterfaceEntry', 'InternalSetIpNetEntry', 'InternalSetIpNetEntry2', 'InternalSetIpStats', 'InternalSetTcpEntry', 'InternalSetTeredoPort', 'InternalSetUnicastIpAddressEntry', 'IpReleaseAddress', 'IpRenewAddress', 'LookupPersistentTcpPortReservation', 'LookupPersistentUdpPortReservation', 'NTPTimeToNTFileTime', 'NTTimeToNTPTime', 'NhGetGuidFromInterfaceName', 'NhGetInterfaceDescriptionFromGuid', 'NhGetInterfaceNameFromDeviceGuid', 'NhGetInterfaceNameFromGuid', 'NhpAllocateAndGetInterfaceInfoFromStack', 'NotifyAddrChange', 'NotifyCompartmentChange', 'NotifyIfTimestampConfigChange', 'NotifyIpInterfaceChange', 'NotifyRouteChange', 'NotifyRouteChange2', 'NotifyStableUnicastIpAddressTable', 'NotifyTeredoPortChange', 'NotifyUnicastIpAddressChange', 'OpenCompartment', 'ParseNetworkString', 'PfAddFiltersToInterface', 'PfAddGlobalFilterToInterface', 'PfBindInterfaceToIPAddress', 'PfBindInterfaceToIndex', 'PfCreateInterface', 'PfDeleteInterface', 'PfDeleteLog', 'PfGetInterfaceStatistics', 'PfMakeLog', 'PfRebindFilters', 'PfRemoveFilterHandles', 'PfRemoveFiltersFromInterface', 'PfRemoveGlobalFilterFromInterface', 'PfSetLogBuffer', 'PfTestPacket', 'PfUnBindInterface', 'ResolveIpNetEntry2', 'ResolveNeighbor', 'RestoreMediaSense', 'SendARP', 'SetAdapterIpAddress', 'SetCurrentThreadCompartmentId', 'SetCurrentThreadCompartmentScope', 'SetDnsSettings', 'SetIfEntry', 'SetInterfaceDnsSettings', 'SetIpForwardEntry', 'SetIpForwardEntry2', 'SetIpInterfaceEntry', 'SetIpNetEntry', 'SetIpNetEntry2', 'SetIpStatistics', 'SetIpStatisticsEx', 'SetIpTTL', 'SetJobCompartmentId', 'SetNetworkInformation', 'SetPerTcp6ConnectionEStats', 'SetPerTcp6ConnectionStats', 'SetPerTcpConnectionEStats', 'SetPerTcpConnectionStats', 'SetSessionCompartmentId', 'SetTcpEntry', 'SetUnicastIpAddressEntry', 'UnenableRouter', 'do_echo_rep', 'do_echo_req', 'if_indextoname', 'if_nametoindex', 'register_icmp', 'AcceptSecurityContext', 'AcquireCredentialsHandleA', 'AcquireCredentialsHandleW', 'AddCredentialsA', 'AddCredentialsW', 'AddSecurityPackageA', 'AddSecurityPackageW', 'ApplyControlToken', 'ChangeAccountPasswordA', 'ChangeAccountPasswordW', 'CloseLsaPerformanceData', 'CollectLsaPerformanceData', 'CompleteAuthToken', 'CredMarshalTargetInfo', 'CredUnmarshalTargetInfo', 'DecryptMessage', 'DeleteSecurityContext', 'DeleteSecurityPackageA', 'DeleteSecurityPackageW', 'EncryptMessage', 'EnumerateSecurityPackagesA', 'EnumerateSecurityPackagesW', 'ExportSecurityContext', 'FreeContextBuffer', 'FreeCredentialsHandle', 'GetComputerObjectNameA', 'GetComputerObjectNameW', 'GetSecurityUserInfo', 'GetUserNameExA', 'GetUserNameExW', 'ImpersonateSecurityContext', 'ImportSecurityContextA', 'ImportSecurityContextW', 'InitSecurityInterfaceA', 'InitSecurityInterfaceW', 'InitializeSecurityContextA', 'InitializeSecurityContextW', 'LsaCallAuthenticationPackage', 'LsaConnectUntrusted', 'LsaDeregisterLogonProcess', 'LsaEnumerateLogonSessions', 'LsaFreeReturnBuffer', 'LsaGetLogonSessionData', 'LsaLogonUser', 'LsaLookupAuthenticationPackage', 'LsaRegisterLogonProcess', 'LsaRegisterPolicyChangeNotification', 'LsaUnregisterPolicyChangeNotification', 'MakeSignature', 'OpenLsaPerformanceData', 'QueryContextAttributesA', 'QueryContextAttributesW', 'QueryCredentialsAttributesA', 'QueryCredentialsAttributesW', 'QuerySecurityContextToken', 'QuerySecurityPackageInfoA', 'QuerySecurityPackageInfoW', 'RevertSecurityContext', 'SaslAcceptSecurityContext', 'SaslEnumerateProfilesA', 'SaslEnumerateProfilesW', 'SaslGetContextOption', 'SaslGetProfilePackageA', 'SaslGetProfilePackageW', 'SaslIdentifyPackageA', 'SaslIdentifyPackageW', 'SaslInitializeSecurityContextA', 'SaslInitializeSecurityContextW', 'SaslSetContextOption', 'SealMessage', 'SeciAllocateAndSetCallFlags', 'SeciAllocateAndSetIPAddress', 'SeciFreeCallContext', 'SecpFreeMemory', 'SecpTranslateName', 'SecpTranslateNameEx', 'SetContextAttributesA', 'SetContextAttributesW', 'SetCredentialsAttributesA', 'SetCredentialsAttributesW', 'SspiCompareAuthIdentities', 'SspiCopyAuthIdentity', 'SspiDecryptAuthIdentity', 'SspiEncodeAuthIdentityAsStrings', 'SspiEncodeStringsAsAuthIdentity', 'SspiEncryptAuthIdentity', 'SspiExcludePackage', 'SspiFreeAuthIdentity', 'SspiGetTargetHostName', 'SspiIsAuthIdentityEncrypted', 'SspiLocalFree', 'SspiMarshalAuthIdentity', 'SspiPrepareForCredRead', 'SspiPrepareForCredWrite', 'SspiUnmarshalAuthIdentity', 'SspiValidateAuthIdentity', 'SspiZeroAuthIdentity', 'TranslateNameA', 'TranslateNameW', 'UnsealMessage', 'VerifySignature']

#---------------------------------------------------------------------------------
#---------------------------------------------------------------------------------


repository: eset/DelphiHelper
file: DelphiHelper.py
url: https://github.com/eset/DelphiHelper/blob/cadbe0356c2ec26f2dab9dd30975b0fbdf267642/DelphiHelper.py
created_at: 2024-12-19 19:42:04+00:00
pushed_at: 2025-04-08 13:19:03+00:00
description:
DelphiHelper is a python IDA Pro plugin aiming to help the analysis of x86/x86_64 binaries written in Delphi programming language.

content:
#
# IDA plugin definition
#
# Copyright (c) 2020-2024 ESET
# Author: Juraj Horňák <juraj.hornak@eset.com>
# See LICENSE file for redistribution.


import ida_auto
import ida_idaapi
import ida_kernwin
from DelphiHelper.core.ClassResolver import ResolveClass, ResolveApplicationClass
from DelphiHelper.core.DFMParser import ParseDFMs
from DelphiHelper.core.EPFinder import *
from DelphiHelper.core.FormViewer import FormViewer
from DelphiHelper.core.IDRKBLoader import *
from DelphiHelper.util.delphi import LoadDelphiFLIRTSignatures
from DelphiHelper.util.exception import DelphiHelperError


PLUGIN_NAME = "DelphiHelper"
PLUGIN_VERSION = "1.20"
PLUGIN_AUTHOR = "Juraj Hornak (juraj.hornak@eset.com)"


class DelphiHelperPlugin(ida_idaapi.plugin_t):
    flags = ida_idaapi.PLUGIN_MOD | ida_idaapi.PLUGIN_MULTI
    comment = PLUGIN_NAME + " - IDA plugin simplifying the analysis of Delphi x86/x64 binaries"
    help = "IDA plugin simplifying the analysis of Delphi binaries"
    wanted_name = PLUGIN_NAME
    wanted_hotkey = "Alt+Shift+H"

    def init(self):
        addon = ida_kernwin.addon_info_t()
        addon.id = "delphi_helper"
        addon.name = PLUGIN_NAME
        addon.producer = PLUGIN_AUTHOR
        addon.url = "juraj.hornak@eset.com"
        addon.version = PLUGIN_VERSION
        ida_kernwin.register_addon(addon)

        LoadDelphiFLIRTSignatures()

        return DelphiHelperPluginMain()


class DelphiHelperPluginMain(ida_idaapi.plugmod_t):

    def __init__(self) -> None:
        ida_idaapi.plugmod_t.__init__(self)

        self.__delphiFormList = list()
        self.__packageinfo = None
        self.__parseFlag = True

        self.hotkeys = []
        self.hotkeys.append(ida_kernwin.add_hotkey("Alt+Shift+R", self.resolveClass))
        self.hotkeys.append(ida_kernwin.add_hotkey("Alt+Shift+E", self.findEntryPointFunc))
        self.hotkeys.append(ida_kernwin.add_hotkey("Alt+Shift+F", self.formViewer))
        self.hotkeys.append(ida_kernwin.add_hotkey("Alt+Shift+S", self.loadIDRKBSignatures_main))
        self.hotkeys.append(ida_kernwin.add_hotkey("Alt+Shift+A", self.loadIDRKBSignatures_custom))

    def run(self, arg):
        self.printHelp()

    def printHelp(self) -> None:
        print("-"*100)
        print(f"{PLUGIN_NAME} ({PLUGIN_VERSION}) by {PLUGIN_AUTHOR}")
        print("Copyright (c) 2020-2024 ESET\n")
        print("IDA plugin simplifying the analysis of Delphi x86/x64 binaries")
        print("\nHotkeys:")

        print("  \"Alt + Shift + R\" - run VMT Parser in order to parse selected VMT structure")
        print("        Usage: Press it in disassembly window when the cursor is on the starting address of a VMT structure")
        print("               e.g.  mov edx, VMT_offset  --> starting address of the VMT structure")
        print("                     call CreateForm\n")

        print("  \"Alt + Shift + F\" - run DFM Finder (show Delphi Form Viewer)")
        print("        Usage: Press it anywhere in the disassembly window")
        print("        Note: The resource section of Delphi file must be loaded by IDA\n")

        print("  \"Alt + Shift + E\" - run Entry Point Function Finder (searching for \"CreateForm\", \"InitExe\" and \"InitLib\" references)")
        print("        Usage: Press it anywhere in the disassembly window\n")

        print("  \"Alt + Shift + S\" - run IDR Knowledge Base Loader for \"SysInit\" and \"System\" unit")
        print("        Usage: Press it anywhere in the disassembly window")
        print("        Note: read the README.md for KB file location.\n")

        print("  \"Alt + Shift + A\" - run IDR Knowledge Base Loader for selected units")
        print("        Usage: Press it anywhere in the disassembly window")
        print("        Note: read the README.md for KB file location.")
        print("-"*100)

    def term(self) -> None:
        for hotkey in self.hotkeys:
            ida_kernwin.del_hotkey(hotkey)

    def findEntryPointFunc(self) -> None:
        msg = "NODELAY\nHIDECANCEL\nSearching for EP function..."
        ida_kernwin.show_wait_box(msg)
        try:
            EPFinder().FindEPFunction()
        except DelphiHelperError as e:
            e.print()
        finally:
            ida_kernwin.hide_wait_box()

    def resolveClass(self) -> None:
        msg = "NODELAY\nHIDECANCEL\nProcessing selected VMT structure..."
        ida_kernwin.show_wait_box(msg)
        try:
            LoadDelphiFLIRTSignatures()
            ida_auto.auto_wait()
            ResolveClass(ida_kernwin.get_screen_ea())
        except DelphiHelperError as e:
            e.print()
        finally:
            ida_kernwin.hide_wait_box()

    def formViewer(self) -> None:
        msg = "NODELAY\nHIDECANCEL\nProcessing Delphi file's DFMs..."
        ida_kernwin.show_wait_box(msg)
        try:
            LoadDelphiFLIRTSignatures()
            ida_auto.auto_wait()
            ResolveApplicationClass()

            if self.__parseFlag:
                self.__delphiFormList = ParseDFMs()
                self.__parseFlag = False

            if self.__delphiFormList:
                FormViewer(self.__delphiFormList)
            else:
                print("[INFO] The Delphi binary seems to not contain any Delphi Form")
        except DelphiHelperError as e:
            e.print()
        finally:
            ida_kernwin.hide_wait_box()

    def loadIDRKBSignatures_custom(self) -> None:
        try:
            KBLoader()
        except DelphiHelperError as e:
            e.print()

    def loadIDRKBSignatures_main(self) -> None:
        try:
            IDRKBLoader(["SysInit", "System"]).LoadIDRKBSignatures()
        except DelphiHelperError as e:
            e.print()


def PLUGIN_ENTRY():
    """Required plugin entry point for IDAPython Plugins.
    """

    return DelphiHelperPlugin()


repository: archercreat/ida_names
file: ida_names.py
description: IDA-names automatically renames pseudocode windows with the current function name.
url: https://github.com/archercreat/ida_names/blob/980fe88450a241b6f5ef21533f4e114ec50fee25/ida_names.py
created_at: 2022-09-13 21:56:30+00:00
pushed_at: 2022-12-24 16:06:23+00:00
content:
import ida_funcs
import ida_idaapi
import ida_kernwin
import ida_hexrays
import ida_name

PLUGIN_HOTKEY = 'Shift-T'
COMMENT       = 'IDA-names automatically renames pseudocode windows with the current function name.'
WANTED_NAME   = 'IDA-names'

def set_window_title(view, newtitle):
    '''
    Recursively iterate qt widgets and change widget title if title matches top widget title.
    '''
    widget   = ida_kernwin.PluginForm.TWidgetToPyQtWidget(view)
    oldtitle = ida_kernwin.get_widget_title(view)

    def set_title_recursive(widget, oldtitle, newtitle):
        if widget is not None:
            curtitle = ida_kernwin.get_widget_title(ida_kernwin.PluginForm.QtWidgetToTWidget(widget))
            if curtitle == oldtitle:
                widget.setWindowTitle(newtitle)
            set_title_recursive(widget.parentWidget(), oldtitle, newtitle)
    set_title_recursive(widget, oldtitle, newtitle)

class hex_hook(ida_hexrays.Hexrays_Hooks):
    def __init__(self, *args):
        super().__init__(*args)

    def refresh_pseudocode(self, vu: ida_hexrays.vdui_t):
        self._set_window_title_to_function_name(vu)
        return 0

    def switch_pseudocode(self, vu: ida_hexrays.vdui_t):
        self._set_window_title_to_function_name(vu)
        return 0

    @staticmethod
    def _set_window_title_to_function_name(vu: ida_hexrays.vdui_t) -> None:
        function_name = ida_funcs.get_func_name(vu.cfunc.entry_ea)
        set_window_title(vu.ct, hex_hook._demangle_name(function_name))

    @staticmethod
    def _demangle_name(name: str) -> str:
        demangled_name = ida_name.demangle_name(name, ida_name.MNG_SHORT_FORM)
        if not demangled_name:
            # IDA's demangler returns an empty string for non-mangled names
            return name

        # Avoid excessively long names by removing the arguments
        return demangled_name.split('(')[0]


def rename_window_cb():
    view = ida_kernwin.get_current_widget()
    if view is not None:
        title    = ida_kernwin.get_widget_title(view)
        newtitle = ida_kernwin.ask_str(title, 0, "New window title")
        if newtitle is not None and newtitle != "":
            set_window_title(view, newtitle)

class ida_names(ida_idaapi.plugin_t):
    def __init__(self):
        self.flags          = ida_idaapi.PLUGIN_KEEP
        self.comment        = COMMENT
        self.help           = COMMENT
        self.wanted_name    = WANTED_NAME
        self.wanted_hotkey  = ''
        self.hotkey_context = None

    def init(self):
        self.hexrays_hook = hex_hook()
        self.hexrays_hook.hook()
        # Add hotkey
        self.hotkey_context = ida_kernwin.add_hotkey(PLUGIN_HOTKEY, rename_window_cb)
        if self.hotkey_context is None:
            ida_kernwin.msg(f'Failed to register {PLUGIN_HOTKEY} hotkey')
        return ida_idaapi.PLUGIN_KEEP

    def run(self, _):
        s = ida_kernwin.ask_yn(1, 'Enable auto renaming of pseudocode windows?\n')
        if s == 1:
            self.hexrays_hook.hook()
        elif s == 0:
            self.hexrays_hook.unhook()

    def term(self):
        self.hexrays_hook.unhook()
        if self.hotkey_context is not None:
            ida_kernwin.del_hotkey(self.hotkey_context)

def PLUGIN_ENTRY():
    return ida_names()


repository: binarly-io/fwhunt-ida
file: fwhunt.py
description: Helper tool for generating FwHunt compliant rules in IDA
url: https://github.com/binarly-io/fwhunt-ida/blob/8ee9a908ad451b178a2220ff15740fd8174d29bf/fwhunt.py
created_at: 2021-09-25 00:08:30+00:00
pushed_at: 2024-10-02 04:22:07+00:00
content:
import logging
import traceback
from typing import Any, Optional

import ida_idaapi
import ida_kernwin
import idc

from fwhunt import ui, utils

NAME = "FwHunt"
AUTHOR = "https://github.com/binarly-io/"

VERSION = "1.0.0"
DESCRIPTION = "Helper tool for generating FwHunt compliant rules"

g_form: Optional[ui.FwHuntForm] = None
g_rule: ui.FwHuntRule = ui.FwHuntRule()

logger = logging.getLogger(NAME)


# -----------------------------------------------------------------------
class FwHuntAction(ida_kernwin.action_handler_t):
    """Basic class for FwHunt action"""

    def __init__(self) -> None:
        ida_kernwin.action_handler_t.__init__(self)

    def update(self, ctx) -> Any:
        if ctx.widget_type == ida_kernwin.BWN_DISASM:
            ida_kernwin.attach_action_to_popup(ctx.widget, None, self.name, "FwHunt/")
            return ida_kernwin.AST_ENABLE_FOR_WIDGET
        return ida_kernwin.AST_DISABLE_FOR_WIDGET


# -----------------------------------------------------------------------
class AddEfiGuid(FwHuntAction):

    name = "AddEfiGuid"
    description = "add GUID to detection rule"
    hotkey = str()

    def __init__(self) -> None:
        super().__init__()

    def activate(self, _ctx) -> bool:
        if g_rule.editor is None:
            return False

        ea = ida_kernwin.get_screen_ea()
        guid = utils.get_guid_value(ea)
        name = utils.get_guid_name(ea)

        logger.info(f"GUID: {guid} # {name}")

        if guid is None:
            return False

        # append GUID to rule
        g_rule.append_guid(guid, name)

        return True


# -----------------------------------------------------------------------
class AddAsciiString(FwHuntAction):

    name = "AddAsciiString"
    description = "add ascii string to detection rule"
    hotkey = str()

    def __init__(self) -> None:
        super().__init__()

    def activate(self, _ctx) -> bool:
        if g_rule.editor is None:
            return False

        ea = ida_kernwin.get_screen_ea()
        logger.info(f"Address: {ea:#x}")
        string = utils.get_ascii_string(ea)

        if string is None:
            return False

        # remove \n
        if "\n" in string:
            string = string.split("\n")[0]
        logger.info(f"String: {string}")

        if not len(string):
            return False

        # append ascii string to rule
        g_rule.append_string(string)

        return True


# -----------------------------------------------------------------------
class AddWideString(FwHuntAction):

    name = "AddWideString"
    description = "add wide string to detection rule"
    hotkey = str()

    def __init__(self) -> None:
        super().__init__()

    def activate(self, ctx) -> bool:
        if g_rule.editor is None:
            return False

        ea = ida_kernwin.get_screen_ea()
        logger.info(f"Address: {ea:#x}")
        string = utils.get_wide_string(ea)

        if string is None:
            return False

        # remove \n
        if "\n" in string:
            string = string.split("\n")[0]
        logger.info(f"Wide string: {string}")

        if not len(string):
            return False

        # append wide string to rule
        g_rule.append_wide_string(string)

        return True


# -----------------------------------------------------------------------
class AddHexString(FwHuntAction):

    name = "AddHexString"
    description = "add hex string to detection rule"
    hotkey = str()

    def __init__(self) -> None:
        super().__init__()

    def activate(self, _ctx) -> bool:
        if g_rule.editor is None:
            return False

        start_ea = idc.read_selection_start()
        end_ea = idc.read_selection_end()
        hex_string = utils.get_hex_string(start_ea, end_ea)

        logger.info(f"Hex string: {hex_string}")

        if hex_string is not None:
            # append hex string to rule
            g_rule.append_hex_string(hex_string)

        return True


# -----------------------------------------------------------------------
class AddCodeSnippet(FwHuntAction):

    name = "AddCodeSnippet"
    description = "add code to detection rule"
    hotkey = str()

    def __init__(self) -> None:
        super().__init__()

    def activate(self, _ctx) -> bool:
        if g_rule.editor is None:
            return False

        start_ea = idc.read_selection_start()
        end_ea = idc.read_selection_end()

        # if selected only one line
        if start_ea == idc.BADADDR and end_ea == idc.BADADDR:
            start_ea = ida_kernwin.get_screen_ea()
            end_ea = idc.next_head(start_ea)

        logger.info(f"Start code address: {start_ea:#x}")
        logger.info(f"End code address: {end_ea:#x}")
        code, comments = utils.get_code(start_ea, end_ea)
        logger.info(f"Code: {code}")

        if code is not None:
            # append hex string to rule
            g_rule.append_code(code, comments)

        return True


# -----------------------------------------------------------------------
class FwHuntHelper(ida_idaapi.plugin_t):
    """FwHunt helper class"""

    flags = 0
    comment = DESCRIPTION
    help = DESCRIPTION
    wanted_name = NAME
    wanted_hotkey = "Ctrl+Alt+F"

    @staticmethod
    def register_action(action, *args) -> None:
        desc = ida_kernwin.action_desc_t(
            action.name, action.description, action(*args), action.hotkey
        )
        ida_kernwin.register_action(desc)

    @staticmethod
    def init() -> Any:
        ida_kernwin.msg(f"\n{NAME} ({VERSION})\n")

        return ida_idaapi.PLUGIN_KEEP

    @staticmethod
    def run(_arg) -> bool:
        global g_form

        if g_form is not None:
            g_form.Close(options=0)

        # initialize the form
        g_form = ui.FwHuntForm()
        g_form.Show("FwHunt rule generator")
        g_rule.install_editor(g_form.rule_preview)
        g_form.fwhunt_scan_info.install_rule(g_rule)

        # add actions
        FwHuntHelper.register_action(AddEfiGuid)
        FwHuntHelper.register_action(AddAsciiString)
        FwHuntHelper.register_action(AddWideString)
        FwHuntHelper.register_action(AddHexString)
        FwHuntHelper.register_action(AddCodeSnippet)

    @staticmethod
    def term() -> None:
        ida_kernwin.unregister_action(AddEfiGuid.name)
        ida_kernwin.unregister_action(AddAsciiString.name)
        ida_kernwin.unregister_action(AddWideString.name)
        ida_kernwin.unregister_action(AddHexString.name)
        ida_kernwin.unregister_action(AddCodeSnippet.name)


# -----------------------------------------------------------------------
# Entry for plugin
def PLUGIN_ENTRY() -> Optional[FwHuntHelper]:
    try:
        return FwHuntHelper()
    except Exception as e:
        logger.error(f"{str(e)}\n{traceback.format_exc()}")
    return None


# -----------------------------------------------------------------------
# Entry for IDAPyhton script
def main() -> None:
    try:
        FwHuntHelper.init()
        FwHuntHelper.run(0)
    except Exception as e:
        logger.error(f"{str(e)}\n{traceback.format_exc()}")


if __name__ == "__main__":
    main()


repository: x64dbg/x64dbgida
file: x64dbgida.py
description: Official x64dbg plugin for IDA Pro.
url: https://github.com/x64dbg/x64dbgida/blob/3d77e99ba3f19310d150e8119bf8aeb4958f66fc/x64dbgida.py
wanted_name: x64dbgida
comment: Official x64dbg plugin for IDA Pro
created_at: 2016-10-07 22:44:48+00:00
pushed_at: 2024-09-24 08:04:45+00:00
content:
import idaapi

# in the future, maybe change for
# ida_idp.IDP_INTERFACE_VERSION >= 700
if idaapi.IDA_SDK_VERSION >= 700:
    import ida_bytes
    import ida_dbg
    import ida_ida
    import ida_kernwin
    import ida_name
    import idautils
    import json
    import traceback
    from idc import *
else:
    print("Use version 1.0")


def MinEA(): return get_inf_attr(ida_ida.INF_MIN_EA)


def MaxEA(): return get_inf_attr(ida_ida.INF_MAX_EA)


def Comment(ea): return ida_bytes.get_cmt(ea, 0)


def RptCmt(ea): return ida_bytes.get_cmt(ea, 1)


initialized = False
BPNORMAL = 0
BPHARDWARE = 1
UE_HARDWARE_EXECUTE = 4
UE_HARDWARE_WRITE = 5
UE_HARDWARE_READWRITE = 6
UE_HARDWARE_SIZE_1 = 7
UE_HARDWARE_SIZE_2 = 8
UE_HARDWARE_SIZE_4 = 9
UE_HARDWARE_SIZE_8 = 10
LAST_EXPORT_FILE_NAME = None


def Comments():
    lastea = 0
    lastcmt = ""
    for ea in range(MinEA(), MaxEA()):
        cmt1 = Comment(ea)
        cmt2 = RptCmt(ea)
        cmt = ""
        if cmt1:
            cmt += cmt1
        if cmt2:
            cmt += cmt2
        if not cmt:
            continue
        skip = ea == lastea + 1 and cmt == lastcmt
        lastea = ea
        lastcmt = cmt
        if not skip:
            yield ea, cmt


def Breakpoints():
    count = ida_dbg.get_bpt_qty()
    for i in range(0, count):
        ea = get_bpt_ea(i)
        bpt = idaapi.bpt_t()
        if not idaapi.get_bpt(ea, bpt):
            continue
        if bpt.type & BPT_SOFT != 0:
            yield ea, BPNORMAL, 0, ida_bytes.get_wide_word(ea)
            continue
        bptype = BPNORMAL if bpt.type == BPT_DEFAULT else BPHARDWARE
        hwtype = {
            BPT_WRITE: UE_HARDWARE_WRITE,
            BPT_RDWR: UE_HARDWARE_READWRITE,
            BPT_EXEC: UE_HARDWARE_EXECUTE
        }[bpt.type]
        hwsize = {
            1: UE_HARDWARE_SIZE_1,
            2: UE_HARDWARE_SIZE_2,
            4: UE_HARDWARE_SIZE_4,
            8: UE_HARDWARE_SIZE_8,
        }[bpt.size]
        yield ea, bptype, (hwtype << 4 | hwsize), 0


def get_file_mask():
    if idaapi.IDA_SDK_VERSION >= 900:
        return "*.dd32" if ida_ida.inf_is_32bit_exactly() else "*.dd64"
    else:
        return "*.dd64" if idaapi.get_inf_structure().is_64bit() else "*.dd32"


def do_import():
    module = idaapi.get_root_filename().lower()
    base = idaapi.get_imagebase()

    file = ida_kernwin.ask_file(0, "x64dbg database|{}".format(get_file_mask()), "Import database")
    if not file:
        return
    print("Importing database {}".format(file))

    with open(file, "r", encoding="utf-8") as dbdata:
        db = json.load(dbdata)

    count = 0
    labels = db.get("labels", [])
    for label in labels:
        try:
            if label["module"] != module:
                continue
            ea = int(label["address"], 16) + base
            name = label["text"]
            ida_name.set_name(ea, str(name), 0)
            count += 1
        except:
            pass
    print("{:d}/{:d} label(s) imported".format(count, len(labels)))

    count = 0
    comments = db.get("comments", [])
    for comment in comments:
        try:
            if comment["module"] != module:
                continue
            ea = int(comment["address"], 16) + base
            name = comment["text"]
            ida_bytes.set_cmt(ea, str(name), 1)
            count += 1
        except:
            pass
    print("{:d}/{:d} comment(s) imported".format(count, len(comments)))

    count = 0
    breakpoints = db.get("breakpoints", [])
    for breakpoint in breakpoints:
        try:
            if breakpoint["module"] != module:
                continue
            ea = int(breakpoint["address"], 16) + base
            bptype = breakpoint["type"]
            if bptype == BPNORMAL:
                count += 1
                ida_dbg.add_bpt(ea, 1, BPT_DEFAULT)
            elif bptype == BPHARDWARE:
                titantype = int(breakpoint["titantype"], 16)
                hwtype = (titantype >> 4) & 0xF
                if hwtype == UE_HARDWARE_EXECUTE:
                    hwtype = BPT_EXEC
                elif hwtype == UE_HARDWARE_WRITE:
                    hwtype = BPT_WRITE
                elif hwtype == UE_HARDWARE_READWRITE:
                    hwtype = BPT_RDWR
                else:
                    continue
                hwsize = titantype & 0xF
                if hwsize == UE_HARDWARE_SIZE_1:
                    hwsize = 1
                elif hwsize == UE_HARDWARE_SIZE_2:
                    hwsize = 2
                elif hwsize == UE_HARDWARE_SIZE_4:
                    hwsize = 4
                elif hwsize == UE_HARDWARE_SIZE_8:
                    hwsize = 8
                else:
                    continue
                count += 1
                ida_dbg.add_bpt(ea, hwsize, hwtype)
        except:
            pass
    print("{:d}/{:d} breakpoint(s) imported".format(count, len(breakpoints)))

    print("Done!")


def do_export(re_export=False):
    global LAST_EXPORT_FILE_NAME
    db = {}
    module = idaapi.get_root_filename().lower()
    base = idaapi.get_imagebase()

    if re_export and LAST_EXPORT_FILE_NAME is not None:
        file = LAST_EXPORT_FILE_NAME
    else:
        file = ida_kernwin.ask_file(1, "x64dbg database|{}".format(get_file_mask()), "Export database")
    if not file:
        return
    print("Exporting database {}".format(file))
    LAST_EXPORT_FILE_NAME = file

    db["labels"] = [{
        "text": name,
        "manual": False,
        "module": module,
        "address": "{:#x}".format(ea - base)
    } for (ea, name) in idautils.Names()]
    print("{:d} label(s) exported".format(len(db["labels"])))

    db["comments"] = [{
        "text": comment.replace("{", "{{").replace("}", "}}"),
        "manual": False,
        "module": module,
        "address": "{:#x}".format((ea - base))
    } for (ea, comment) in Comments()]
    print("{:d} comment(s) exported".format(len(db["comments"])))

    db["breakpoints"] = [{
        "address": "{:#x}".format(ea - base),
        "enabled": True,
        "type": bptype,
        "titantype": "{:#x}".format(titantype),
        "oldbytes": "{:#x}".format(oldbytes),
        "module": module,
    } for (ea, bptype, titantype, oldbytes) in Breakpoints()]
    print("{:d} breakpoint(s) exported".format(len(db["breakpoints"])))

    with open(file, "w", encoding="utf-8") as outfile:
        json.dump(db, outfile, indent=1)
    print("Done!")


try:  # we try because of ida versions below 6.8, and write action handlers below
    class AboutHandler(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            a = x64dbg_plugin_t()
            a.about()
            return 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS
except AttributeError:
    pass

try:
    class EksportHandler(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            b = x64dbg_plugin_t()
            b.exportdb(False)
            return 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

except AttributeError:
    pass


class ReeksportHandler(idaapi.action_handler_t):
    def __init__(self):
        idaapi.action_handler_t.__init__(self)

    def activate(self, ctx):
        b = x64dbg_plugin_t()
        b.exportdb(True)
        return 1

    def update(self, ctx):
        return idaapi.AST_ENABLE_ALWAYS


try:
    class ImportHandler(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        # Say hello when invoked.
        def activate(self, ctx):
            c = x64dbg_plugin_t()
            c.importdb()
            return 1

        # This action is always available.
        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS
except AttributeError:
    pass


class x64dbg_plugin_t(idaapi.plugin_t):
    comment = "Official x64dbg plugin for IDA Pro"
    version = "v2.0"
    website = "https://github.com/x64dbg/x64dbgida"
    help = ""
    wanted_name = "x64dbgida"
    wanted_hotkey = ""
    flags = idaapi.PLUGIN_KEEP

    def init(self):
        global initialized

        if initialized is False:
            initialized = True
            self._initialize()

        return idaapi.PLUGIN_KEEP

    def _initialize(self):
        if idaapi.IDA_SDK_VERSION < 700:
            print("Use version 1.0")
            return

        menu_path = 'Edit/x64dbgida/'

        # populating action menus
        action = 'my:aboutaction'
        action_desc = idaapi.action_desc_t(
            action,  # The action name. This acts like an ID and must be unique
            'About!',  # The action text.
            AboutHandler(),  # The action handler.
            '',  # Optional: the action shortcut
            'About X64dbg ida',  # Optional: the action tooltip (available in menus/toolbar)
        )  # Optional: the action icon (shows when in menus/toolbars) use numbers 1-255
        idaapi.register_action(action_desc)
        idaapi.attach_action_to_menu(menu_path, action, idaapi.SETMENU_APP)

        label = 'Export x64dbg database'
        action = 'my:eksportaction'
        action_desc = idaapi.action_desc_t(action, label, EksportHandler(), '', label)
        idaapi.register_action(action_desc)
        idaapi.attach_action_to_menu(menu_path, action, idaapi.SETMENU_APP)

        label = 'Re-Export database'
        action = 'my:reeksportaction'
        action_desc = idaapi.action_desc_t(action, label, ReeksportHandler(), 'Ctrl+Alt+Shift+q', label)
        idaapi.register_action(action_desc)
        idaapi.attach_action_to_menu(menu_path, action, idaapi.SETMENU_APP)

        label = 'Import (uncompressed) database'
        action = 'my:importaction'
        action_desc = idaapi.action_desc_t(action, label, ImportHandler(), '', label)
        idaapi.register_action(action_desc)
        idaapi.attach_action_to_menu(menu_path, action, idaapi.SETMENU_APP)

    def run(self, arg):
        self.about()
        pass

    def term(self):
        return

    def importdb(self):
        try:
            do_import()
        except:
            traceback.print_exc()
            print("Error importing database...")

    def exportdb(self, re_export):
        try:
            do_export(re_export)
        except:
            traceback.print_exc()
            print("Error exporting database...")

    def about(self):
        print("{} {}".format(self.wanted_name, self.version))
        print(self.comment)
        print(self.website)


def PLUGIN_ENTRY():
    return x64dbg_plugin_t()


repository: blacktop/symbolicator
file: plugins/ida/symbolicate.py
description: `ipsw` symbolication signatures
wanted_name: ipsw' Symbolicate Plugin
comment: Symbolicate Plugin
created_at: 2024-07-17 00:06:45+00:00
pushed_at: 2025-05-07 17:52:32+00:00
url:
https://github.com/blacktop/symbolicator/blob/b64d5e06159155fb6d3058fb09a0e0e72be28a71/plugins/ida/symbolicate.py

content:
# MIT License
#
# Copyright (c) 2024 blacktop
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

import json
from pathlib import Path

import ida_funcs
import ida_loader
import ida_name
import idaapi

SYMBOLS_LOADED_INDICATION = '.symbols_loaded'


class SymbolicatePlugin(idaapi.plugin_t):
    flags = 0
    comment = "Symbolicate Plugin"
    help = "This plugin prompts the user for a symbol map JSON file and processes it."
    wanted_name = "'ipsw' Symbolicate Plugin"
    wanted_hotkey = "Alt-F8"

    def init(self):
        print("Symbolicate Plugin initialized.")
        return idaapi.PLUGIN_OK

    def run(self, arg):
        file_path = idaapi.ask_file(0, "*.json", "Select a symbol map JSON file")
        if file_path:
            self.process_json_file(file_path)
        else:
            print("No file selected.")

    def process_json_file(self, file_path: str) -> None:
        try:
            with open(file_path, "r") as file:
                data = json.load(file)
                self.process_symbol_map(data)
        except Exception as e:
            print(f"Failed to load symbol map JSON file: {e}")

    def process_symbol_map(self, addr2sym):
        count = 0
        for addr, sym in addr2sym.items():
            addr = int(addr, 10)
            # Check if the address is valid
            if not idaapi.is_loaded(addr):
                print(f"Error: Address {hex(addr)} is not valid for this binary")
                continue
            # Create a function if it doesn't exist
            if not ida_funcs.get_func(addr):
                if ida_funcs.add_func(addr):
                    print(f"Created function at address {hex(addr)}")
                else:
                    print(f"Failed to create function at address {hex(addr)}")
                    continue
            # Set the function name (which also creates the symbol)
            if ida_name.set_name(addr, sym, idaapi.SN_FORCE):
                print(f"[Symbolicated] 0x{addr:x}: {sym}")
                count += 1
            else:
                print(f"❌ Failed to set name for function at address {hex(addr)}")

        print(f"🎉 Symbolicated {count} addresses 🎉")

    def term(self):
        pass


def PLUGIN_ENTRY():
    result = SymbolicatePlugin()
    bin_file = ida_loader.get_path(ida_loader.PATH_TYPE_CMD)
    json_file = Path(bin_file + '.symbols.json')
    symbols_loaded_indication_file = Path(bin_file + SYMBOLS_LOADED_INDICATION)
    if json_file.exists() and not symbols_loaded_indication_file.exists():
        result.process_json_file(str(json_file))
        # indicate that symbols were already loaded so don't force reload
        # every time
        symbols_loaded_indication_file.touch()
    return result


repository: carlosgprado/MILF
file: milf.py
description: An IDA Pro swiss army knife (with a sexy name!)
url: https://github.com/carlosgprado/MILF/blob/a98506c4061444ff6e0fbb79ca0c57a41177a3b5/milf.py
wanted_name: MILF
comment: MILF. Satisfying your (RE) basic needs.
created_at: 2012-06-06 19:03:33+00:00
pushed_at: 2013-03-15 18:08:20+00:00
content:
#
# milf.py
#
# Some useful methods in vulnerability discovery.
# Let the snake make your life a bit easier
#
# Implemented using the idaapi and idautils modules

import re

from idaapi import *
from idautils import *
from idc import *

########################################
# NetworkX (optional) support
# for advanced graphs
try:
    import networkx as nx
    import malplotlib.pyplot as plt
    NetworkX = True
except:
    print "[debug] Deactivating support for NetworkX library"
    NetworkX = False

###################################################################################################
class IDAnalyzer():
    
    
    def __init__(self, debug = False, nx_support = True):
        ''' initialization of the main class '''
        self.import_dict = dict()
        self.debug = debug
        self.nx_support = nx_support

                    
        # Create a dictionary with all imports.
        # It populates self.import_dict
        self._enum_all_imports()
        
    
    def banner(self):
        ''' It has to be :) '''
        
        print "IDAnalyzer.\n"
        print "it's python, biatch\n"
                
                
    def mark_dangerous(self):    
        '''
        Colorize dangerous function calls!
        No arguments.
        
        @return: True '''
        
        dangerousFuncs = ["strcpy", "strncpy", "memmove", "memcpy", "sprintf", "lstrcpyW", "lstrcpyA", "memset"]
                
        # Loop from start to end within the current segment
        for FuncName in dangerousFuncs:
            func_addr = LocByName(FuncName)
            if self.debug:
                print "Function %s at %08x" % (FuncName, func_addr)
            
            # find all code references to the function
            for ref in CodeRefsTo(func_addr, True):
                if self.debug:
                    print "\tcalled from %s (%08x)" % (GetFunctionName(ref), ref)
                # Color the function call *RED*
                SetColor(ref, CIC_ITEM, 0x2020c0)
        
        return True
        
                
    def mark_switches(self, graph, color = 0x20c020):
        '''
        Convenience function. It colors all switches in a graph.
        @type graph: dictionary
        @param graph: Complex data structure. See connect_graph()
        
        @type color: hex
        @param color:(optional) color to mark the switches
         
        @return: True '''
        
        switches = self.enum_switches(graph)
        for sw in switches.keys():
            SetColor(sw, CIC_ITEM, color)
        
        
        return True
        
        
    def _enum_all_imports(self):
        '''
        Useful afterwards for resolving addresses to imports.
        Following code has been taken shamelessly from the "ex_imports.py" distribution example :)
        
        @rtype: dictionary
        @return: dictionary containing import name & address { name : idata_ea } '''
        
        nimps = get_import_module_qty() # How many modules imported?
        
        if self.debug:
            print "[debug] Found %d imported modules" % nimps
        
        for i in xrange(0, nimps):
            name = get_import_module_name(i)
            if not name:
                print "[x] Could not get import module name for #%d" % i
                continue
            
            # The import_dict dictionary will be filled
            # through this callback function (_imp_cb)
            enum_import_names(i, self._imp_cb)
             
        return self.import_dict  
    
    
    def _imp_cb(self, ea, name, ord):
        '''
        Used by _enum_all_imports.
        Callback function used by idaapi.enum_import_names()
        
        @return: True ''' 
        if not name:
            self.import_dict[ord] = ea
        else:
            self.import_dict[name] = ea
            
        return True
 
    
    def _find_import_name(self, iaddr):
        '''
        Translates addresses to import names through a dictionary lookup.
        
        @type iaddr: address
        @param iaddr: Address of import
        
        @return: name (if successful) or same argument (on failure)  '''
        
        for k in self.import_dict.keys():
            if self.import_dict[k] == iaddr:
                name = k
                
        if name:
            return name
        else:
            return iaddr
    
    
    def graph_down(self, ea, graph = {}, path = set([])):
        '''
        Creates a downgraph of xrefs FROM this function.
        Calling it recursively allow us to get infinite depth.
        
        @type ea: ()
        @param ea: address of ROOT NODE
        
        @rtype: dictionary
        @return: Dictionary of function ea's and child *addresses* { ea : [c1_ea, c2_ea, ...] } '''
        
        graph[ea] = list()    # Create a new entry on the graph dictionary {node: [child1, child2, ...], ...}
        path.add(ea)        # This is a set, therefore the add() method
        
        # Iterate through all function instructions and take only call instructions
        for x in [x for x in FuncItems(ea) if is_call_insn(x)]:        # Take the call elements
            for xref in XrefsFrom(x, XREF_FAR):                                   
                if not xref.iscode:
                    continue
                        
                if xref.to not in path:        # Eliminates recursions
                    graph[ea].append(xref.to)
                    self.graph_down(xref.to, graph, path)
                    
        return graph


    def graph_up(self, ea, graph = {}, path = set([])):
        '''
        Creates an upgraph of xrefs TO this function.
        Calling it recursively allow us to get infinite depth.
        
        @type ea: address
        @param ea: address of ROOT NODE (bottom)
        
        @rtype: dictionary
        @return: Dictionary of function ea's and parent addresses { ea : [p1_ea, p2_ea, ...] } '''
        
        graph[ea] = list()    # Create a new entry on the graph dictionary {node: [child1, child2, ...], ...}
        path.add(ea)        # This is a set, therefore the add() method
        
    
        for xref in XrefsTo(ea, XREF_FAR):
            if not xref.iscode:
                continue
            
            func = get_func(xref.frm) # self.func -> idaapi.func_t
            if not func:
                continue
            else:
                caller_addr = func.startEA
                                
            if caller_addr not in path:        # Eliminates recursions
                graph[ea].append(caller_addr)
                self.graph_up(caller_addr, graph, path)
                
                
        return graph


    def _colorize_graph(self, node_list, color = 0x2020c0):
        '''
        Internal method. See show_path() for an example wrapper.
        It paints a *list* of functions with some color.
        
        @type graph: List
        @param graph: List of nodes_ea
        
        @type color: hex
        @param color: (optional) color to paint the functions  '''

        for x in node_list:
            SetColor(x, CIC_FUNC, color)
        
        return True
    
        
    def reset_colorize_graph(self, c_graph):
        '''
        Convenience method.
        Set color back to white for selected graph.
        
        @type graph: List
        @param graph: List of nodes
        
        @note: Call with "all" string to reset the whole module. '''

        WHITE = 0xffffff
        
        if c_graph == 'all':
            for function in Functions():
                SetColor(function, CIC_FUNC, WHITE)
        else:
            self._colorize_graph(c_graph, WHITE)
            
        return True
    
        
    def _translate_ea_name(self, ea):
        '''
        Translates an ea to a function/import name.
        
        @type ea: address
        @param ea: address to lookup
        
        @return: function/import name (on success) or same argument (on failure) '''
        
        t = GetFunctionName(ea)
        if not t:
            if SegName(ea) == '.idata':
                # The address is inside the imports section
                t = self._find_import_name(ea)
                if not t:
                    t = ea
            else:
                t = ea
                
        return t
    
        
    def translate_graph(self, graph):
        '''
        Takes a graph, { node: [child1, child2, ...], ...}
        and lookup as many function names as possible.
        
        @type graph: dictionary
        @param graph: dictionary of function ea's and "child" nodes { ea : [c1_ea, c2_ea, ...] }
        
        @rtype: dictionary
        @return: same dictionary but names instead of ea's (where possible) '''
        
        translated_graph = dict()
        
        # This loop translates the dict keys (nodes)
        for node in graph.keys():
            translated_key = self._translate_ea_name(node)
            translated_graph[translated_key] = list()
            # This loop translates the dict values (children)
            for child in graph[node]: # traverses a list
                translated_graph[translated_key].append(self._translate_ea_name(child))
                    
            
        return translated_graph         



    def connect_graph(self, origin, destination):
        '''
        Take a wild guess...
        
        @type origin: string
        @param origin: Function NAME
        
        @type destination: string
        @param destination: Function NAME
        
        @rtype: dictionary
        @return: Complex data  { 
                                 node_ea : {
                                            'node': node_ea, 
                                            'children': [child1_ea, child2_ea...],
                                            'parents': [parent1_ea, parent2_ea] 
                                            },
                                 ...} '''

        gdown = self.graph_down(LocByName(origin))
        gup = self.graph_up(LocByName(destination))
        
        gconnect = dict()
        
        for node_ea in gdown.keys():
            if node_ea in gup.keys():
                gconnect[node_ea] = dict()
                gconnect[node_ea]['node'] = node_ea
                gconnect[node_ea]['children'] = gdown[node_ea]
                gconnect[node_ea]['parents'] = gup[node_ea]
            else:
                pass
        
        
        return gconnect
    
    
    def connect_graph_import(self, origin, destination):
        '''
        Wrapper to connect_graph(). This allows origin to be an import.
        Ex. Graph between "recv" and "WriteFile"
        
        @type origin: string
        @param origin: Function NAME
        
        @type destination: string
        @param destination: Function NAME
        
        @note: This returns several "connect graphs", one for every function 
               calling the "origin" import. Indexed by address.
               See connect_graph() for graph type definition.
               
        @rtype:  dictionary
        @return: Complex data {imp_caller1_ea : connect_graph1, ...} '''
        
        graph_dict = dict()
        import_callers_dict = self._find_import_callers(origin)
        
        for imp_caller_addr in import_callers_dict.keys():
            # imp_caller_addr is the address within the function, where 
            # the actual call instruction is located, not the ea (beginning) 
            imp_caller_name = GetFunctionName(imp_caller_addr)
            imp_caller_ea = LocByName(imp_caller_name)
            graph_dict[imp_caller_ea] = self.connect_graph(imp_caller_name, destination)
            
        return graph_dict
    
         
        
    def advanced_connect_graph(self, origin, destination):
        '''
        Using networkx library.
        http://networkx.lanl.gov
        @todo: As with ConnectGraph!OnRefresh, improve the clumsy algorithm :) '''
        
        if self.nx_support:
            
            gdown = self.graph_down(LocByName(origin))
            gup = self.graph_up(LocByName(destination))
            
            nx_gconnect = nx.DiGraph()
            
            gconnect = self.connect_graph(origin, destination)
            
            for x in self.gconnect.itervalues():
                node_ea = x['node']
                nx_gconnect.add_node(node_ea)
                for c in x['children']:
                    try:
                        nx_gconnect.add_node(c)
                        nx_gconnect.add_edge(node_ea, c)
                    except:
                        continue
                for p in x['parents']:
                    try:
                        nx_gconnect.add_node(p)
                        nx_gconnect.add_edge(p, node_ea)
                    except:
                        continue
                    
            nx.draw(nx_gconnect)
            plt.show()
            
            return True
                            
        else:
            print "[debug] Sorry, support for networkx is *disabled*"
            return False
        
        
        
    def show_path(self, origin, destination, color = 0x2020c0):
        '''
        Colorizes a path.
        Originally though to be useful to visualize "connect graphs".
        
        @type origin: string
        @param origin: Function NAME
        
        @type destination: string
        @param destination: Function NAME
        
        @rtype: dictionary
        @return: Complex struct. See connect_graph() '''
        
        conn_graph = self.connect_graph(origin, destination)
        
        # The connection graph is a complex data structure, but
        # _colorize_graph() argument is a list of nodes
        graph_list = [x['node'] for x in conn_graph.itervalues()]
        
        self._colorize_graph(graph_list, color)
        
        return conn_graph
    
    
    def enum_switches(self, graph):
        '''
        Enumerate all switches in downgraph
        Shamelessly copied from Aaron Portnoy :)
        
        @type graph: graph
        @param graph: Complex structure. See connect_graph()
        
        @rtype: dictionary
        @return: dictionary { address : [cmp_mnem, disasm] } '''

        switch_dict = dict()
        jmpList = ['jmp', 'jz', 'jnz', 'jg', 'jl', 'ja', 'jb']
                
        # Extract a *list* of nodes from the graph data structure
        graph_list = [x['node'] for x in graph.itervalues()]
                 
        for func_start in graph_list:
            # if the function end isn't defined (probably a library call) then skip it
            func_end = FindFuncEnd(func_start)
            if func_end == 0xFFFFFFFF:
                continue

            for instr in FuncItems(func_start):
                # check for switch jump                    
                if GetMnem(instr) in jmpList:
                    # step backwards and find the cmp for the # of cases (if possible)
                    prev_instruction = PrevHead(instr, 0)

                    count = 5
                    while count > 0:
                        if GetMnem(prev_instruction) == 'cmp':
                            # get comparison number, plus for for case 0
                            cmp_mnem = GetDisasm(prev_instruction)
                            switch_dict[instr] = [cmp_mnem, GetDisasm(instr)]
                            break
                        
                    prev_instruction = PrevHead(prev_instruction, 0)    
                    count -= 1


        return switch_dict
    
    
    def imm_compares(self, graph):
        '''
        Find all immediate compares in a graph.
        It's useful when analyzing proprietary formats.

        @type graph: graph
        @param graph: Complex data structure. See connect_graph()
        
        @rtype: dictionary
        @return: dictionary of { addr : [op1, op2], ... } '''
        
        imm_cmp = dict()
        
        # Extract a *list* of nodes from the graph data structure
        graph_list = [x['node'] for x in graph.itervalues()]
        
        for func_start in graph_list:
            # if the function end isn't defined (probably a library call) then skip it
            func_end = FindFuncEnd(func_start)
            if func_end == 0xFFFFFFFF:
                continue

            for instr in FuncItems(func_start):
                disasm = GetDisasm(instr)
                if 'cmp' in disasm:
                    if GetOpType(instr, 1) == 5: # immediate value
                        if self.debug:
                            print "[debug] imm cmp at 0x%08x: %s" % (instr, GetDisasm(instr))
                        imm_cmp[instr] = [GetOpnd(instr, 0), GetOpnd(instr, 1)]
                        

        return imm_cmp


    def mark_imm_compares(self, color = 0x2020c0):
        '''
        Mark all immediate compares in the current function.
        Very useful when debugging parsers, for example.
        
        @type color: hex
        @param color: color for the mark '''
        
        for instr in FuncItems(ScreenEA()):
            disasm = GetDisasm(instr)
            if "cmp" in disasm:
                if GetOpType(instr, 1) == 5: # immediate value
                    if self.debug:
                        print "[debug] imm cmp at 0x%08x: %s" % (instr, GetDisasm(instr))
                    SetColor(instr, CIC_ITEM, color)
                    
        return True
    
    
    def function_bb_connect(self, bb_src_ea, bb_dst_ea, color = 0x2020c0):
        '''
        Graphically connect (color) basic blocks within a function.
        It could save your life! :) '''
        
        set_down = set([])
        set_up = set([])
        self.color = color
        
        
        # Nasty trick to get function's start EA
        f = get_func(bb_src_ea) # func_t object
        
        
        # Calculate the downgraph (originating at bb_src_ea)
        set_down = self._aux_calc_down_set(f, [bb_src_ea])
            
        # Calculate the upgraph set (originating at bb_dst_ea)
        set_up = self._aux_calc_up_set(f, [bb_dst_ea])
        
        ConnectedPaths = set_down.intersection(set_up)
        
        if ConnectedPaths:
            for PathBlock in ConnectedPaths:
                SetColor(PathBlock, CIC_ITEM, self.color)
        else:
            print "[debug] No path connecting those two basic blocks :("


    def _aux_calc_down_set(self, f, CurrentBlockLayer, DownGraphBlockSet = set([])):
        '''
        Analogous to graph_down().
        To set the "root" block, call with CurrentBlockLayer = [bb_src_ea] 
        
        @rtype: set
        @return: set containing upgraph blocks '''
        
        self.FuncFlowChart = FlowChart(f)
        self.CurrentBlockLayer = CurrentBlockLayer
        self.NextBlockLayer = list()
        
        # Iterate through all basic blocks and get the egress connections.
        for bb in self.CurrentBlockLayer:                    # bb: address
            block = self._aux_lookup_ea_bb(f, bb)
            for enode in block.succs():                        # enode: basic block type
                if enode.startEA not in DownGraphBlockSet:    # Eliminates recursions
                    self.NextBlockLayer.append(enode.startEA)
                    DownGraphBlockSet.add(enode.startEA)
                    self._aux_calc_down_set(f, self.NextBlockLayer, DownGraphBlockSet)
                
        return DownGraphBlockSet
        
        
    def _aux_lookup_ea_bb(self, f, ea):
        '''
        Returns a basic block object given an address
        
        @type f: func_t object
        @param f: represents the function of interest
        
        @type ea: address
        @param ea: address of the basic block
        
        @rtype: Basic Block Object
        @return: well... a basic block object :) '''
        
        self.f = f
        self.ea = ea
        self.FlowChart = FlowChart(f)
        
        for bb in self.FlowChart:
            if bb.startEA == self.ea:
                return bb
            
        return False
        
        
        
        
    def _aux_calc_up_set(self, f, CurrentBlockLayer, UpGraphBlockSet = set([])):
        '''
        Auxiliary function. I couldn't make Basic Block preds() work,
        so I need to calculate the upgraph myself.
        Note: preds(), I kill you! :) '''
        
        self.FuncFlowChart = FlowChart(f)
        self.CurrentBlockLayer = CurrentBlockLayer
        self.NextBlockLayer = list()
        
        
        for block in self.FuncFlowChart: # full lookup (it could be enhanced)
            for bsuccs in block.succs():    # .succs() returns a generator
                if bsuccs.startEA in CurrentBlockLayer: # it's a parent
                    if block.startEA not in UpGraphBlockSet:
                        self.NextBlockLayer.append(block.startEA)
                        UpGraphBlockSet.add(block.startEA)
                        self._aux_calc_up_set(f, self.NextBlockLayer, UpGraphBlockSet)
        
        return UpGraphBlockSet
        
        
        
        
                    
    def function_graph(self, ea):
        '''
        It creates a graph of basic blocks and their children.
        
        @type ea: address
        @param ea: address anywhere within the analyzed function.
        
        @rtype: dictionary
        @return: dictionary { block_ea: [branch1_ea, branch2_ea], ... } '''
        
        bb_dict = dict()
        f = FlowChart(get_func(ea))    #FlowChart object
        
        for bb in f:
            bb_dict[bb.startEA] = list()        # Dict of BasicBlock objects
            for child in bb.succs():
                bb_dict[bb.startEA].append(child.startEA)
        
        return bb_dict
    

    
    def locate_function_call(self, func_name, callee):
        '''
        Convenience function. It locates a particular function call *within a function*.
        
        @type func_name: string
        @param func_name: NAME of the function containing the call
        
        @type callee: string
        @param callee: NAME of the function being called
        
        @rtype: List
        @return: List of addresses ("call callee" instructions) 
        
        @todo: IIRC this needs to be improved/fixed '''
        
        call_addr_list = list()
        func_ea = LocByName(func_name)    # returns startEA
        
        # If there's a thunk, it won't be called directly from the function (dough!)
        # Is the callee located inside .idata section and called through a thunk?
        callee_ea = LocByName(callee)
        xr = XrefsTo(callee_ea, True)
        xrl = list(xr) # ugly but easy
        if len(xrl) == 1:  # thunks are call bottlenecks
            xrf = get_func(xrl[0].frm)
            if (xrf.flags & idaapi.FUNC_THUNK) != 0:
                # it IS a thunk
                callee = GetFunctionName(xrl[0].frm)
                
        for instr in FuncItems(func_ea):
            disasm = GetDisasm(instr)
            if "call" in disasm and callee in disasm:
                call_addr_list.append(instr)
                if self.debug:
                    print "[debug] Found", disasm, "at %08x" % instr
        
        return call_addr_list
    
    
    def dangerous_size_param(self, color = 0xFF8000, mark = False):
        '''
        Some functions copy buffers of size specified by a size_t parameter.
        If this isn't a constant, there's a chance that it can be manipulated 
        leading to a buffer overflow.
        Example: void *memset( void *dest, int c, size_t count ); '''
        
        regexp = ".*memset|.*memcpy|.*memmove|.*strncpy|.*strcpy.*|.*sncpy"
        candidate_dict = self._find_import_callers(regexp)
        
        for candidate_ea, imp_ea_list in candidate_dict.iteritems():
            # For every candidate function, look for the calls 
            # to dangerous functions within it
            for danger_ea in imp_ea_list:
                func_caller = GetFunctionName(candidate_ea)
                imp_callee = Name(danger_ea)
                # List of addresses within the function ("call dangerous_func")
                addr_list = self.locate_function_call(func_caller, imp_callee)
            
                if addr_list:
                    print "------ Analysing %s ------" % func_caller
                    tmp_push_list = list()
                    func_start = LocByName(func_caller)
                    func_end = FindFuncEnd(func_start)
                    # if the function end isn't defined (probably a library call) then skip it
                    if func_end == 0xFFFFFFFF:
                        continue
                    
                    for instr in FuncItems(func_start):
                        disasm = GetDisasm(instr)
                        # List with addresses of push instructions
                        if "push" in disasm:
                            tmp_push_list.append(instr) # address of the push instruction
                        elif instr in addr_list:
                            if len(tmp_push_list) >= 3: # sanity check :)
                                push_size_addr = tmp_push_list[-3]
                                if GetOpType(push_size_addr, 0) < 5: # This can be improved
                                    print "[debug] %08x - %s" % (instr, GetDisasm(push_size_addr))
                                    if mark == True:
                                        SetColor(instr, CIC_ITEM, 0x2020c0)
                        else:
                            continue
                
        return True
        
        
    def locate_file_io(self, interactive = False):
        '''
        Convenience function
        Finds interesting IO related *imports* and the functions calling them.
        Call with interactive = True to display a custom viewer ;)
        
        @rtype: Dictionary (of lists)
        @return: Dictionary containing the functions calling the imported functions,
                 {fn_ea: [file_io1_ea, file_io2_ea, ...], ...} '''
        
        # The meat and potatoes is the regexp
        regexp = ".*readf.*|.*write.*|.*openf.*|f.*print.*"
        callerDict = self._find_import_callers(regexp)
        
        if interactive:
            file_io_cview = SuspiciousFuncsViewer()
            if file_io_cview.Create("File IO", callerDict):                    
                file_io_cview.Show()
            else:
                print "[debug] Failed to create custom view: File IO" 
            
            
        return callerDict
    
    
    def locate_net_io(self, interactive = False):
        '''
        Convenience function
        Finds interesting network related *imports* and the functions calling them.
        Call with interactive = True to display a custom viewer ;)
        
        @rtype: Dictionary (of lists)
        @return: Dictionary containing the functions calling the imported functions,
                 {fn_ea: [net_io1_ea, net_io2_ea, ...], ...} '''
        
        # The meat and potatoes is the regexp
        regexp = "recv|recvfrom|wsa.*"
        callerDict = self._find_import_callers(regexp)

        if interactive:
            net_io_cview = SuspiciousFuncsViewer()
            if net_io_cview.Create("Net IO", callerDict):
                net_io_cview.Show()
            else:
                print "[debug] Failed to create custom view: Net IO" 

        
        return callerDict
    
        
    def locate_allocs(self, interactive = False):
        '''
        Convenience function
        Finds interesting allocation related *imports* and the functions calling them.
        Call with interactive = True to display a custom viewer ;)
        
        @rtype: Dictionary (of lists)
        @return: Dictionary containing the functions calling the imported functions,
                 {fn_ea: [alloc1_ea, alloc2_ea, ...], ...} '''
        
        # The meat and potatoes is the regexp
        regexp = ".*alloc.*|.*free.*"
        callerDict = self._find_import_callers(regexp)

        if interactive:
            allocs_cview = SuspiciousFuncsViewer()
            if allocs_cview.Create("Allocs", callerDict):
                allocs_cview.Show()
            else:
                print "[debug] Failed to create custom view: Allocs" 

        
        return callerDict


    def locate_most_referenced(self, number = 10, interactive = False):
        ''' Identifying these is an important first step '''
        
        self.number = number
        self.interactive = interactive
        referenceDict = dict()
        topReferencesDict = dict()
        
        for funcAddr in Functions():
            refNumber = sum(1 for e in XrefsTo(funcAddr, True)) # stackoverflow ;)
            referenceDict[funcAddr] = refNumber
        
        # Log to IDA's output window and to a custom viewer <3
        print "Top %d most referenced functions" % self.number
        
        NrResults = 0
        # Let's order this stuff nicely
        for func_ea, refnumber in sorted(referenceDict.iteritems(), reverse = True, key = lambda (k, v): (v, k)):
            NrResults += 1 # control counter
            if NrResults > self.number:
                break
            else:
                print "%s : %s" % (GetFunctionName(func_ea), refnumber)
                topReferencesDict[func_ea] = refnumber
                
        # Create the custom viewer
        if self.interactive:
            toprefs_cview = SuspiciousFuncsViewer()
            if toprefs_cview.Create("Top referenced", topReferencesDict):
                toprefs_cview.Show()
            else:
                print "[debug] Failed to create custom view: Top referenced"
                
                
        return topReferencesDict

        
    def _find_import_callers(self, regexp):
        '''
        Finds interesting imported functions and the nodes that call them. 
        Very handy in locating user inputs.
        
        @attention: There are imports called through a thunk and directly.
        @rtype: Dictionary (of lists)
        @return: Dictionary containing *the address of the functions* 
                 calling the imports,
                 {fn_call_ea: [idata1_ea, idata2_ea, ...], ...}
                  
        @todo: IIRC this needs some review '''
        
        importCallers = dict()
        importPattern = re.compile(regexp, re.IGNORECASE)
        
        for imp_name, idata_ea in self.import_dict.iteritems():
            # This dict has the *IAT names* (i.e. __imp_ReadFile, within the .idata section)
            if importPattern.match(imp_name):
                for import_caller in XrefsTo(idata_ea, True):
                    import_caller_addr = import_caller.frm
                    import_caller_fn = get_func(import_caller_addr)
                    
                    if import_caller_fn:
                        
                        # Check if caller is a THUNK
                        if (import_caller_fn.flags & idaapi.FUNC_THUNK) != 0:
                            # It IS a thunk
                            for thunk_caller in XrefsTo(import_caller_addr, True):
                                thunk_caller_fn = get_func(thunk_caller.frm)
                                import_caller_ea = thunk_caller_fn.startEA
                                if importCallers.has_key(import_caller_ea):
                                    # Remove nasty duplicates
                                    if idata_ea in importCallers[import_caller_ea]:
                                        continue
                                    else:
                                        importCallers[import_caller_ea].append(idata_ea)
                                else:
                                    importCallers[import_caller_ea] = [idata_ea]
                                    
                        else:
                            # It is NOT a thunk, no need for recursion                    
                            import_caller_ea = import_caller_fn.startEA
                            
                            if importCallers.has_key(import_caller_ea):
                                # Remove nasty duplicates
                                if idata_ea in importCallers[import_caller_ea]:
                                    continue
                                else:
                                    importCallers[import_caller_ea].append(idata_ea)
                            else:
                                importCallers[import_caller_ea] = [idata_ea]

                    else:
                        #import_caller_fn is None
                        pass
                    
                    
        return importCallers


    def export_functions_to_file(self, extended = False):
        '''
        Export all the function start addresses to a file. This will be used by a tracer.
        The extended option logs the number of arguments as well. '''
        
        self.extended = extended
        filename = AskFile(1, "*.*", "File to export functions to?")
        
        f = open(filename, "w")
        print "Exporting function addresses to %s\n" % filename
        
        idx = 0
        
        # The string format is:
        # 0xAAAAAAAA-0xBBBBBBBB {ea_start, ea_end}
        
        for function_start in Functions():
            function_end = GetFunctionAttr(function_start, FUNCATTR_END)
            # Below I've just stripped the leading '0x' chars
            addr_interval_string = str(hex(function_start)).split('0x')[1] + '-' + str(hex(function_end)).split('0x')[1]
            
            if self.extended:
                # Get the number of function args
                frame = GetFrame(f)
                if frame is None: continue
                ret = GetMemberOffset(frame, " r")
                if ret == -1: continue
                firstArg = ret + 4
                NumberOfArguments = (GetStrucSize(frame) - firstArg)/4     # Every arg on the stack is 4 bytes long
                addr_interval_string += ",%d" % NumberOfArguments 

            f.write(addr_interval_string  + '\n')
            idx += 1
            
        f.close()
        
        print "%d functions written to disk" % idx
            

    def import_functions_from_file(self):
        '''
        Import all the function start addresses to a file.
        Rudimentary differential debugging, yay! '''    
        
        filename = AskFile(0, "*.*", "File to import functions from?")
        print "Importing function start addresses from %s\n" % filename
        
        idx = 0        
        f = open(filename, 'r')
        function_addresses = f.readlines()  # I still have to strip them
        f.close()
        
        imported_fn_dict = dict()
                
        for fa in function_addresses:
            f_addr = int(fa.split('-')[0], 16)
            imported_fn_dict[f_addr] = GetFunctionName(f_addr)
            SetColor(f_addr, CIC_FUNC, 0x188632)
            idx += 1
        
        print "[debug] %d functions imported from file" % idx
        
        # A custom viewer doesn't hurt :)
        imported_fn_cview = SuspiciousFuncsViewer()
        if imported_fn_cview.Create("Specific Functions", imported_fn_dict, onhint_active = False):                    
            imported_fn_cview.Show()
        else:
            print "[debug] Failed to create custom view: Specific Functions" 
    

    def import_basic_blocks_from_file(self):
        '''
        Import hit basic blocks from a detailed PIN Trace.
        A choser allows to somehow re-trace execution within 
        the functions we are interested in. '''    
        
        filename = AskFile(0, "*.*", "File to import basic blocks from?")
        print "Importing basic block addresses from %s\n" % filename
        
        token = '$'
        idx = 0
                
        f = open(filename, 'r')
        lines = f.readlines()
        f.close()

        bb_addresses = list()
        
        for li in lines:
            if token in li:
                bb_addresses.append(int(li.split(token)[1].strip(), 16))
                
        # Process the list for loops
        analyzed_trace = self._find_trace_loops(bb_addresses)
        
        # Love lambda functions :)
        TraceElements = [[GetFunctionName(x), hex(x), GetDisasm(x)] for x in bb_addresses]
        MilfBBTraceSelector("Basic blocks hit during Intel's PIN trace", TraceElements, 0, parent = self).show()
            
        
    def _find_trace_loops(self, bb_addr):
        '''
        Simple algorithm to reduce small loops in trace files.
        Loops of the type a -> b -> a ... are identified.
        @return: two-dimensional list (int addr, str comment), where the comment 
                 indicate the number of times the loop occurred or empty string if none. '''
        
        idx     = 0
        loop     = 0
        
        while idx < len(bb_addr):
            # Implement a simple logic here
            pass
        
        
        
        
        
    def usage(self):
        '''On screen help'''
        
        print "Exported ia object (IDAnalyzer class instance)"
        print "some cool methods:\n"
        
        methods = []
        for x in dir(self):
            if not x.startswith("_"):
                if callable(getattr(self, x)):
                    methods.append(str(x))
        
        for m in methods:
            print "- ia." + m
        
       
       
###################################################################################################
class ConnectGraph(GraphViewer):
    
    def __init__(self, graph):
        GraphViewer.__init__(self, "Connect Graph")
        self.graph = graph

        
    def OnRefresh(self):
        '''@todo: this algorithm is a bit clumsy. Get back to it.'''
        
        self.Clear()
        idNode = dict() # { node_ea : node_id }
        
        for x in self.graph.itervalues():
            # First, add all nodes and populate the idNode list
            node_ea = x['node']
            idNode[node_ea] = self.AddNode(node_ea)
        
        for node_ea, x in self.graph.iteritems():
            # Link the node with parents and children
            # These 'children' elements are *all* references from the node,
            # not just the ones belonging to the connected graph.
            for c in x['children']:
                try:
                    self.AddEdge(idNode[node_ea], idNode[c])
                except:
                    continue
                
            for p in x['parents']:
                try:
                    self.AddEdge(idNode[p], idNode[node_ea])
                except:
                    continue
        
        # Calculate a handy reverse dictionary { node_id: node_ea}
        self.AddrNode = dict()
        for ea,id in idNode.iteritems():
            self.AddrNode[id] = ea
                    
        return True


    def DisasmAround(self, node_id):
        '''
        Writes the function disassembly 
        (around interesting function calls)
        @todo: identify fn call with pure asm, not strings :/ '''
        
        interesting_fn_names = list()
        node_ea = self.AddrNode[node_id]
        
        # We are interested in the function calls from the node, which
        # are actually part of the connected graph :)
        for x in self.graph[node_ea]['children']:
            if x in self.graph.keys(): # node list
                interesting_fn_names.append(GetFunctionName(x))
        
        position = 0
        fi = FuncItems(node_ea)
        f_items = list(fi) # generator -> list
        
        NodeText = "[ %s ]\n\n" % GetFunctionName(node_ea)
        
        for ins in f_items:
            # Find call to interesting function and
            # slice around the call in disasm
            disasm = GetDisasm(ins)
            if "call" in disasm:
                for name in interesting_fn_names:
                    if name in disasm:
                        print "[debug] *** Found call", name, position
                        disasm_slice = f_items[position - 3 : position + 3]
                        for instr in disasm_slice:
                            #print "    [debug] disasm_around()", GetDisasm(instr)
                            NodeText += GetDisasm(instr)
                            NodeText += "\n"
                            
                        NodeText += "--------\n"                        
            
            position += 1
            
        return NodeText
    
    
    def OnGetText(self, node_id):
        return (self.DisasmAround(node_id), 0x800000)
    
    
    def OnDblClick(self, node_id):
        ''' Double clicking on a node, jump to it in disassembly '''
        Jump(self.AddrNode[node_id])
        return True
        
        
    def OnSelect(self, node_id):
        print "[debug]", hex(self.AddrNode[node_id]), "selected"
        return True
    
    
    def OnHint(self, node_id):
        return hex(self.AddrNode[node_id])
    
    
    def OnClick(self, node_id):
        return True
    
    
    def OnCommand(self, cmd_id):
        '''
        Triggered when a menu command is selected through the menu of hotkey
        @return: None '''
        
        if cmd_id == self.cmd_close:
            self.Close()
            return
        
            
    def Show(self):
        if not GraphViewer.Show(self):
            return False
        
        # Add some handy commands to the graph view :)
        self.cmd_close = self.AddCommand("Close", "F2")
        if self.cmd_close == 0:
            print "[debug] Failed to add popup menu item for GraphView"
        
        return True


###################################################################################################
class SuspiciousFuncsViewer(simplecustviewer_t):
    
    def Create(self, sn = None, dict_fn = None, onhint_active = True):
        '''
        This is analog to the __init__ method when superclassing.
        
        @todo: dict_refs connects line numbers (as the custom viewer) with function info.
               How will it work when we delete/add lines (de-synchronize?) '''
        
        self.dict_fn = dict_fn
        self.onhint_active = onhint_active
        
        
        title = "Hot spots"
        if sn:
            add_title = " (%s)" % sn
            title += add_title
        
        # Check that it doesn't exist already and Create it
        f = find_tform(title)
        if f:
            print "[debug] Form %s exists already" % title
            return False
        
        if not simplecustviewer_t.Create(self, title):
            return False
        
        
        # Write some information
        comment = idaapi.COLSTR("; Double click to follow", idaapi.SCOLOR_BINPREF)
        self.AddLine(comment)
        comment = idaapi.COLSTR("; Hover for preview", idaapi.SCOLOR_BINPREF)
        self.AddLine(comment)
        
        # Write entries
        if self.dict_fn:
            self.dict_refs = dict()
            
            line_idx = 2    # offset due to initial comments
            for fn_ea, imp_ea_list in self.dict_fn.iteritems():
                self.dict_refs[line_idx] = [fn_ea, imp_ea_list]
                
                EntryName = GetFunctionName(fn_ea)
                if not EntryName:
                    EntryName = hex(fn_ea)
                    
                self.AddEntry(EntryName)
                line_idx += 1
                

        
        # Some popup menu items go here...
        self.menu_jmp_graph = self.AddPopupMenu("Jump to graph", 'F2')
        self.menu_delete_line = self.AddPopupMenu("Delete current entry", 'F3')
        self.menu_mark_line = self.AddPopupMenu("Mark this entry", 'F4')
        
        return True


    def AddEntry(self, entry_text):
        '''
        I own you, machine
        '''    
        entry = idaapi.COLSTR(entry_text, idaapi.SCOLOR_STRING)
        self.AddLine(entry)
        
        return True

    
    def DelEntry(self, line_no):
        '''
        This is in case I would like to add, for example,
        a confirmation dialog in the future
        '''
        self.DelLine(line_no)
        
        return True

    
    def MarkCurrentLine(self):
        line_no = self.GetLineNo()
        line = self.GetCurrentLine(notags = 1)
        marked_line = idaapi.COLSTR("[x] " + line, idaapi.SCOLOR_NUMBER)
        self.EditLine(line_no, marked_line)
    
        return True

    
    def OnClick(self, shift):
        return True

    
    def OnDblClick(self, shift):
        fn_string = self.GetCurrentWord()
        if fn_string[:2] == '0x':
            fn_ea = int(fn_string, 16)
        else:
            fn_ea = LocByName(fn_string)
            
        Jump(fn_ea)
        
        return True

    
    def OnHint(self, lineno):
        
        if not self.onhint_active:
            pass
        
        if lineno < 2:
            return False
        
        OnHintParameter = self.dict_refs[lineno][1]
        if type(OnHintParameter) == list:
            hint_string = "It calls: "
            for c in OnHintParameter:
                hint_string += "%s, " % Name(c)
        else:
            hint_string = "%s" % OnHintParameter#
                
        color_hint = idaapi.COLSTR(hint_string, idaapi.SCOLOR_STRING)    
        return (1, color_hint)
    
    
    def OnKeyDown(self, vkey, shift):
        if vkey == 27:    # ESC
            self.Close()
        elif vkey == ord('R'):
            print "Refreshing..."
            self.Refresh()
        else:
            return False
        
        return True
    
    
    def OnPopup(self):
        pass
    
    
    def OnPopupMenu(self, menu_id):
        if menu_id == self.menu_jmp_graph:
            self.OnDblClick(None)
        elif menu_id == self.menu_delete_line:
            line_no = self.GetLineNo()
            self.DelEntry(line_no)
        elif menu_id == self.menu_mark_line:
            self.MarkCurrentLine()
        else:
            # Unhandled
            return False
        
        return True


###################################################################################################
class MilfPlugin(idaapi.plugin_t):
    ''' This registers the plugin within IDA Pro '''
    
    flags = 0
    comment = "MILF. Satisfying your (RE) basic needs."
    help = "For your everyday RE tasks"
    wanted_name = "MILF"
    wanted_hotkey = "Alt-F8"
    
    
    def init(self):
        idaapi.msg("MILF initialized\n")
        self.icon_id = 0
        # Instance of the IDAnalyzer class
        self.ia = IDAnalyzer(debug = True, nx_support = NetworkX)
        
        return idaapi.PLUGIN_KEEP
    
    
    def AddMenuElements(self):
        '''Menus are better than no GUI at all *sigh*'''
        
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Select Origin Basic Block", "", 0, self.MilfMarkOriginBB, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Select Destination Basic Block", "", 0, self.MilfMarkDestBB, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Connect Blocks!", "", 0, self.MilfConnectBlocks, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Most referenced functions", "", 0, self.MilfMostReferenced, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Connect Graph", "Ctrl+F8", 0, self.MilfConnGraph, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Mark dangerous functions", "Ctrl+F9", 0, self.MilfMarkDangerous, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Mark immediate compares", "Ctrl+F10", 0, self.MarkImmCompares, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Locate allocs", "Ctrl+F11", 0, self.MilfLocateAllocs, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Locate network IO", "Ctrl+F12", 0, self.MilfLocateNetIO, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Mark dangerous size params", "", 0, self.MilfMarkDangerousSize, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Reset all markings", "", 0, self.MilfResetMarkings, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Export function addresses to disk", "", 0, self.MilfExportFunctions, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Export function addresses (and arguments info) to disk", "", 0, self.MilfExportFunctionsAdvanced, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Import function addresses from file", "", 0, self.MilfImportFunctions, ())
        idaapi.add_menu_item("Edit/Plugins/", "MILF: Import basic blocks from file", "", 0, self.MilfImportBasicBlocks, ())

    
    def run(self, arg = 0):
        idaapi.msg("[debug] MILF's plugin_t run() called\n")
        idaapi.msg("You can start using MILF right now.\n")
        # Load icon from file (convenient but not portable :/)
        self.icon_id = idaapi.load_custom_icon(file_name = "M.ico")
        if self.icon_id == 0:
            raise RuntimeError("[debug] failed to load icon file")
        
        # Some menus are in order!
        self.AddMenuElements()
    
    
    def MilfMarkOriginBB(self):
        self.src_basic_block = ScreenEA()
        print "[Debug] Selected Origin Basic Block (0x%08x)" % self.src_basic_block
        
        return True
        
    
    def MilfMarkDestBB(self):
        self.dst_basic_block = ScreenEA()
        print "[Debug] Selected Destination Basic Block (0x%08x)" % self.dst_basic_block
        
        return True
    
    
    def MilfConnectBlocks(self):
        if self.src_basic_block and self.dst_basic_block:
            self.ia.function_bb_connect(self.src_basic_block, self.dst_basic_block)
            print "[Debug] Drawing connect graph..."
        else:
            print "[Debug] Check that you selected all parameters"
        
        return True

        
    def MilfMostReferenced(self, number = 10):
        self.ia.locate_most_referenced(number = 10, interactive = True)
        
        
    def MilfMarkDangerous(self):
        self.ia.mark_dangerous()
    
    
    def MarkImmCompares(self):
        self.ia.mark_imm_compares()
        
            
    def MilfConnGraph(self):        
        # Love lambda functions :)
        moduleFunctions = [[hex(x), GetFunctionName(x)] for x in Functions()]
        MilfFuncSelector("Select Functions to Connect", moduleFunctions, self.icon_id, parent = self).show()


    def MilfLocateAllocs(self):
        self.ia.locate_allocs(interactive = True)

        
    def MilfLocateNetIO(self):
        self.ia.locate_net_io(interactive = True)

        
    def MilfResetMarkings(self):
        self.ia.reset_colorize_graph('all')

        
    def MilfMarkDangerousSize(self):
        self.ia.dangerous_size_param(mark = True)

        
    def MilfExportFunctions(self):
        self.ia.export_functions_to_file()


    def MilfExportFunctionsAdvanced(self):
        self.ia.export_functions_to_file(extended = True)

        
    def MilfImportFunctions(self):
        self.ia.import_functions_from_file()

        
    def MilfImportBasicBlocks(self):
        self.ia.import_basic_blocks_from_file()
        
        
    def term(self):
        idaapi.msg("term() called\n")
        ######### Cleanup #########
        # Free the icon
        if self.icon_id != 0:
            idaapi.free_custom_icon(self.icon_id)


###################################################################################################
class MilfFuncSelector(Choose2):
    ''' Chooser class. Let's keep things pretty :P '''
    
    def __init__(self, title, items, icon, parent, embedded = False):
        Choose2.__init__(self, title, [["Address", 12], ["Functions", 30]], embedded = embedded)
        self.items = items
        self.icon = icon
        self.parent = parent
        self.g_origin = None
        self.g_destination = None
 
        
    def GetItems(self):
        return self.items
 
    
    def SetItems(self, items):
        self.items = [] if items is None else items
 
        
    def OnClose(self):
        pass
 
    
    def OnGetLine(self, n):
        return self.items[n]
 
    
    def OnGetSize(self):
        return len(self.items)
 
    
    def OnSelectLine(self, n):
        # Callback for double-clicks
        pass
 
    
    def OnCommand(self, n, cmd_id):
        if cmd_id == self.cmd_origin:
            # mark as source
            self.g_origin = self.items[n][1]
            print "[debug] Graph origin: %s" % self.g_origin
        elif cmd_id == self.cmd_dst:
            # mark as destination
            self.g_destination = self.items[n][1]
            print "[debug] Graph destination: %s" % self.g_destination
        elif cmd_id == self.cmd_graph:
            # Graph it!
            print "[debug] Creating Graph: %s -> %s" % (self.g_origin, self.g_destination)
            gc = self.parent.ia.connect_graph(self.g_origin, self.g_destination)
            if gc:
                gv = ConnectGraph(gc)
                gv.Show()               
        else:
            print "[debug] Command not understood"
        
        return True
    
    
    def show(self):
        # It replaces the native Show() method
        t = self.Show()
        if t < 0:
            return False
        else:
            # Add some context menus :)
            self.cmd_origin = self.AddCommand("Set as origin")
            self.cmd_dst = self.AddCommand("Set as destination")
            self.cmd_graph = self.AddCommand("Graph it")
            return True


###################################################################################################
class MilfBBTraceSelector(Choose2):
    ''' Displays the basic blocks hit during the Intel's PIN detailed trace. '''
    
    def __init__(self, title, items, icon, parent, embedded = False):
        Choose2.__init__(self, title, [["Function", 20], ["Address", 8], ["Disassembly", 20]], embedded = embedded)
        self.items = items
        self.icon = icon

        
    def GetItems(self):
        return self.items

    
    def SetItems(self, items):
        self.items = [] if items is None else items

        
    def OnClose(self):
        pass

    
    def OnGetLine(self, n):
        return self.items[n]

    
    def OnGetSize(self):
        return len(self.items)

    
    def OnSelectLine(self, n):
        ''' Callback for double-click '''
        
        trace_addr = int(self.items[n][1], 16)
        SetColor(trace_addr, CIC_ITEM, 0x3db43d)
        Jump(trace_addr)

    
    def OnCommand(self, n, cmd_id):
        '''Callback for contextual menu'''
        
        if cmd_id == self.cmd_follow:
            # jmp to position in graph view
            Jump(int(self.items[n][1], 16))
        else:
            print "[debug] Command not understood"
        
        return True
    
    
    def show(self):
        ''' It replaces the native Show() method '''
        
        t = self.Show()
        if t < 0:
            return False
        else:
            # Add some context menus :)
            self.cmd_follow = self.AddCommand("Follow in graph")
            return True
        
        
###################################################################################################
def PLUGIN_ENTRY():
    return MilfPlugin()
    


